I think that the answer is ALL OF THE ABOVE.
Effective planning for information security involves 1) collecting information about an organization's objectives. 2) collecting information about an organization's information security environment, and 3) collecting information about an organization's technical architecture.
Information security is defined as the is a set of strategies for managing the processes, tools and policies necessary to prevent, detect, document and counter threats to digital and non-digital information.
Based on the definition, planning for an effective information security involves company's objectives, its current information security set-up, and the technical aspects of how information is formatted, stored, and disseminated without jeopardizing its confidentiality.
