Defense-in-Policy begets Defense-in-Depth

The majority of companies today focus solely on technical requirements for an information security program. When addressing the legendary AIC triad, companies focus on pulling controls from three categories: Administrative, Technical/Logical, and Physical/Environmental. Often, the Administrative category is overlooked, disregarded, and not given enough focus and attention from the business which can spell disaster for the security process as it provides the foundation and framework for the entire security program. One can no longer rely on technology alone to secure the perimeter, or for ad- hoc stove-pipe solutions to provide peace of mind. Organizations that invest more understanding and resources into their Administrative controls find security to be an enabling factor in their business instead of a process that is controlling and limiting to their business.