In an organization, an Information Technology security function should:

A.
Be a function within the information systems function of an organization.

B.
Report directly to a specialized business unit such as legal, corporate security or insurance.

C.
Be lead by a Chief Security Officer and report directly to the CEO.

D.
Be independent but report to the Information Systems function.

Explanation:
This is one of the best practices because its not good to be lead and report to the same person, in
that case, that person could take possession of everything that is happening and hurt the enterprise,
we can’t let that to happen with security concerns. The best practice is to always be lead by a
different person that the one you report to, this can be checked in real life. An advice, always try to
report to the highest person you can inside the company.