security managers are accountable for the day-to-day operation of the information security program.