Building a Comprehensive IT Security Program: Practical Guidelines and Best Practices