The agency consists of five major units, each with several large computer facilities. Each facility runs multiple applications. This type of organization needs to manage security at the agency level, the unit level, the computer facility level, and the application level. Managing computer security at multiple levels brings many benefits. Each level contributes to the overall security program with different types of expertise, authority, and resources.
Most organizations have at least two levels of security management.
The central security program addresses the overall management of security within the organization or a major component of the organization, including such activities as policy development and oversight. The system level security program focuses on the management of security for a particular information processing system. This function includes activities such as selecting and installing safeguards and may be performed by users, functional managers, or computer systems personnel. Information to be shared includes policies, regulations, standards, training opportunities, and security incident reports. Internal security-related information, such as procedures which worked or did not work, virus infections, security problems and solutions also should be shared within an organization.