Independence is best provided for IT security by placing it within the IT department.

• A. True
• B. False
• C. Not sure
• D. Not applicable

Answer: (B)

Independence in IT security comes from giving the security function autonomy and a governance line outside of day-to-day IT operations. If security sits inside the IT department, it can be influenced by IT priorities like speed and feature delivery, which can undermine strict controls and risk management. A separate security leadership—often a CISO with authority across the whole organization and a reporting line to executive leadership or the board—enables objective risk assessments, independent testing, policy enforcement, and cross‑department incident response. This separation provides checks and balances and ensures security decisions reflect organizational risk, not just IT delivery needs. So independence is not best provided by placing IT security within the IT department; it comes from a governance structure that grants security clear, overarching authority while still enabling collaboration with IT.