Today's chief information security officer, schooled by the Common Body of Knowledge for Information Security, CISSP and CISM handbooks, and reliant on frameworks such as ISO 27001, tackles security as a collection of individual issues rather than holistically.