The various information security architectures and models are the result of a lot of consideration and experience, over decades of a lot of very smart people trying hard to get it right. To be ignorant of such foundational work is to be at a severe disadvantage in practical matters.

 

A building supervisor may not need to be a boiler technician, but he or she must absolutely understand the fundamentals of HVAC systems to be at all effective. Likewise the position may not require the skills of an architect, but absolutely demand a thorough familiarity with load-bearing structures, and an ability to evaluate what is necessary to maintain their integrity.

 

It is the same with information security program management.

 

/jonathan