While overall responsibility for an information security program is normally assigned to a person in the security department or the information technology department, development of an information security awareness program is probably best structured as a joint project with the training department.