Access to information and information assets can be partially or completely interrupted by natural disasters, accidents, equipment failures, or malicious activities. As Mary Lou Emmons explains, appropriate business continuity planning — planning for the unexpected — must be undertaken to protect the availability of critical information resources and continuity of operations.

Indeed the Information Security & Privacy Program focuses primarily on applying safeguards, though most are preventive against unintended & unauthorized use & exposure. If & when prevention fails, IU must be able to detect & respond to incidents. What's more, the process of preparing for, detecting, responding to, and tracking such incidents directly impacts the reduction of frequency & severity.

The Communications and Operations Management domain describes a robust, reliable, and secure IT infrastructure that lends itself to information protection. Meeting this goal requires implementing safeguards, including policies, standards, and procedures that guide how systems are operated and how the institution processes information.

The Information Security & Privacy Program's Physical and Environmental Security domain focuses on protecting buildings, rooms, and equipment that house information. Additionally, it raises awareness of protecting equipment that houses information when not in a secure location -- like a laptop or tablet in a car.