IU is a large, complex institution. A clear management structure must be in place in order to provide an official Information Security & Privacy Program that collates guidance and advice for divisional leadership. Oversight and strategic guidance for such a program is provided by the Information Security & Privacy Risk Council, an advisory group chaired by IU's Chief Privacy and Security Officers.