This whitepaper has a good overview of key components of a risk based security plan, which have been put into practice on several occasions.  This provides good direction with a decent amount of detail.

Site Requires Registration:

• Search Security

The document is about 12 pages explaining the steps for performing a risk assessment to developing a security plan to determining security budget.