While a decentralized model could work well in certain situations, Wood's Option 1 provides a balance by maintaining a close relationship between InfoSec and IT. This arrangement ensures that security measures are integrated seamlessly into IT operations without creating unnecessary bureaucratic layers, which might be more suitable for a company that is not highly information intensive. Of course, the specific context and nuances of Company XYZ's operations should be considered for a more accurate recommendation