The University of SydneyPage 19Four Classes of Formal IS Security1.Responsibility and authority structures2.Security strategy and policy3.Business processes4.Roles and skillsDimensions:–Organisationalbuy-in–Security policy