Information security management must be independent of operations to provide objective oversight. When the ISM also serves as system administrator, they effectively oversee their own work, eliminating independent verification of security controls. The ISM should define requirements and audit compliance, not implement and operate systems.