The University of Wisconsin-Madison is implementing a comprehensive information technology security program suitable for both large enterprise systems and diverse departmental systems. We will describe the process of design and implementation of the program.