Why? No one single person should decide on where the information security belongs within the organization. Within different departments there should be someone making decisions on where the information security function belongs depending on the need of that department's goals and resources.
