Re: Security program development (Plan)

Larry,

the size, shape and reporting relationship of the security organization will 
depend upon the size, shape, etc. of the organization itself - plus the culture 
of the organization.

An approach to determining what fits your organization is to use reference 
material (and ISO17799 is only one small piece of what you should study) to 
determine the security organization's mission and objectives.

Define those and you'll begin to see where security should 'sit'. 

It may be a mistake but I detect, in your post, a major urge to 'just get 
security out of ops'. A word of advice from a veteran: If this is your major 
objective (as opposed to finding the 'right' place for security) you'll wind up 
only with a sore head, a broken heart or both.