As discussed, it$$s important that security is included within general IT change management practices and supporting policy frameworks. This helps to ensure and reinforce the role of security within these routine practices as a systematic support system and keeps it from being a one$-$off endeavor for identified instances.

In this exercise, your task is to identify areas within your environment $($or any environment in general$)$ where security is built in from the ground floor with regard to routine IT processes and procedures. With this context in mind, answer the following key questions:

Which areas of IT management have a strong presence and integrated approach to security?

Which areas, processes, or practices do not have a strong approach to security?

Is security embedded within general IT functions by process or policy?

Which areas for improvement or gap areas currently exist? What can be done to remedy them?