OVERVIEW

Information security has been elevated in importance because of significant losses from security breaches and the importance of information on the way we live and conduct business. Information driven by technology has a pervasive impact on the infrastructure that supports governments, businesses, consumers, and individual citizens. There is also the ever-present risk of a major cyber attack that could impact the critical national information infrastructure.

There have been a number of legislative initiatives that deal with information security that have been passed, most notably the Sarbanes-Oxley Act of 2002, which impacts publicly traded companies subject to U.S. security laws. In addition, Congress and state governments have passed laws that govern how companies must address the issues of information security. All too frequently, information security is treated as strictly a technology issue when in reality it is a governance concern.

Until the focus created by the financial scandals and Sarbanes-Oxley took the problem to corporate boardrooms, the matter of information security was treated as a technology matter. In many instances, information security still continues to be shuffled aside or delegated to lower level personnel. In December 2001, the National Association of Corporate Directors (NACD) in conjunction with KPMG's Audit Committee Institute published a report titled Informtion Systems Governance: What Directors Need to Know that addressed information and security head-on. This level of visibility is now getting the problem on the radar screen. Chapter 8 created the foundation for understanding information technology and its impact on reliable financial reporting. Information...