Security isn't a project or even a program. It is a practice that must be ingrained in every aspect of your environment... and it is never "done".