The Requirement for an Information Security Plan