We have developed a custom process that uses ISO-27001, CObIT, the SANS Top 20 Security Controls for Effective Cyber Defense, and the Framework of Risk Management and Analysis (FoRMA) to identify strengths and weaknesses in an Information Security Program. Our process covers a broad area of security controls across technology layers and organizational responsibilities from the perspective of both attackers and defenders.