A company policy concerning accountability of information Information Systems are systems which use exactly that - information. An effective information resource protection program identifies the information used by the agency and assigns primary responsibility for information protection to the managers of the respective functional areas supported by the data. These managers know the importance of the data to the organization and are able to quantify the economic consequences of undesirable happenings. They are also able to detect deficiencies in data and know definitively who must have access to the data supporting their operations. A fundamental information protection issue is assignment of accountability.
Information flows throughout the organization and can be shared by many individuals.
This tends to blur accountability and disperse decision-making regarding information protection. Accountability should be explicitly assigned for determining and monitoring security for appropriate agency information. This policy should explicitly state the value to the agency of data and information resources and the need to preserve their integrity, availability, and confidentiality. There should be clear statements concerning the intent of the organization to protect the resources from accidental or deliberate unauthorized disclosure, modification, or destruction by employing cost-effective controls. Managers in all areas of an organization are clearly accountable for the protection of any of these resources assigned to them to enable them to perform their duties.