Firstly, discuss the ideal information security governance structure by referring to the

organisational hierarchy, information security positions it should comprise, reporting lines and where the office of the chief information officer should reside.