The six steps in the information security program are life cycle identification, assessment, design, implementation, protection, and monitoring.