Governance over information security policies fits at more management levels. Consequently, both business and technology leaders work closely together to ensure value is delivered. However, the actual implementation of information security policies is far more complex and requires deep technical knowledge. The implementation of ISS policies often falls to the technology teams of an organization. With technology ingrained into today’s society, protecting information is everyone’s concern. As you discovered about information systems security, there is more to consider than just the wires and computers.

Organizations rely as much on information systems as they do on human resources. In a production facility, computers control most manufacturing devices. In a nuclear power plant, electrical generation and contamination containment rely on controlling systems to ensure the flow of power keeps the lights on safely. In a legal office, an aide researches thousands of documents and case law through a remote vast online database. These are just a few examples of the impact information systems have on a daily basis. As you can see, technology continues to become a greater part of our daily lives.

FIGURE 1-6 shows the seven domains of a typical IT infrastructure. Each domain provides unique policy requirements. Within each domain, ISS policies are vital to maintaining a secure work environment that protects the information resources critical to their individual requirements. It is becoming harder and harder to understand and protect networks when outside vendors are involved, such as a cloud service provider. You may not have direct access to vendor systems that support your network, so you may not have the assurance that your network is fully protected.