Question

Where should an infosec unit be placed within an organization? where shouldn't it be placed?

Answer 1

Infosec stands for information security program, which is the program that identifies and contains any and all risks that may be posed to the information sector of the company. Absent any internal contradiction the information security unit should be placed in the information technology department of the organization. If there is an internal contradiction, then the security and information sectors should not be placed together, but instead in separate divisions of the organization.