Most IT security analysts recommend placing IT security functions within the IT department.

• A. True
• B. False
• C. Not sure
• D. Not applicable

Answer: (B)

The important idea here is how security leadership and accountability are structured. While IT handles day-to-day operations, IT security needs objective oversight and cross‑functional visibility to manage risk effectively. Putting security entirely inside the IT department can create conflicts of interest or limit security decisions to operational IT concerns, reducing independence and the ability to enforce broad, enterprise-wide risk management.

Best practice is to establish IT security as its own function with dedicated leadership (such as a CISO) that has authority and typically reports to senior management, the board, or an audit/risk committee. This allows security to set policy, oversee risk across all departments, coordinate incident response, and address regulatory and contractual requirements with the necessary independence. In practice, security still works closely with IT, but its governance and reporting structure keep risk management objective and visible at the highest levels of the organization.

So the statement is not generally correct—the preferred approach is for IT security to operate with its own governance and oversight, rather than being housed entirely within the IT department.