IT people also don’t have much experience at developing policies and procedures for handling security issues beyond the technical issues, says Anne Rogers, director of information safeguards for Waste Management. According to Rogers, responsibility for security polices and procedures across the company has moved from IT to Waste Management’s corporate security function, while responsibility for selecting technology platforms and implementation remains with IT (a security management structure that former CIO Smith disagrees with). "We’re looking at security policies and procedures above and beyond IT and how those systems affect other areas in the company," she says. "There are skills and background for doing this that security people have and most IT people don’t." For his part, Smith says IT retains responsibility for security policies and procedures that affect IT systems. It’s an example of the struggle over security that is beginning to occur in many companies.

Use Independent Audits

Mary Finlay, deputy CIO of Partners HealthCare System, has information security reporting to her. She acknowledges the conflict of interest. For health-care companies like hers, she says, the conflict is swept away by external regulations like the Health Insurance Portability and Accountability Act (HIPAA) and auditing bodies that have strict terms for compliance. "There are three arms to HIPAA, and one of them is all about security," Finlay says. She says Partners also has internal and external auditing groups and an internal compliance group that monitor information security issues. That’s a lot of checking and balancing. For companies that don’t have that kind of external scrutiny and regulation, a separate information security function may be their only independent voice. "I do agree that you need the checks and balances in place somehow," says Finlay. "I like that there is this separate part of the organization that is keeping us on our toes."

Rod Hamilton, CIO of Hygeia, a health-care provider network, says the size of his company and his budget doesn’t warrant having a separate information security function. He was able to bring in a person who spends half his time on security tasks by devoting the rest of the time to database analysis. HIPAA defines the more strategic, high-level thinking about security that this staffer does not have the time for. "HIPAA is a godsend in a way because it gives us a clear definition of what we should be doing and gives us the opportunity to bring someone else in to say whether we are meeting the requirements," says Hamilton.