Information Security Handbook

Information security is a business project not an IT project

The information security program should be executed under the authority of the organization's business/mission leaders. An information security program that operates as an IT project is often viewed as a technology deployment. Rather than a well-aligned business project, organizational users will think the information security program is about deploying firewalls and intrusion detection systems. While these are very important tools, the information security program acts as an advocate between the business and IT, helping to ensure that the business's information security requirements are well articulated and implemented by IT.