Information security projects should be prioritized on the basis of:

time required for implementation.

impact on the organization. 

total cost for implementation. 

mix of resources required.