They arent responsible, subcontractor is. As I posted some time ago:<p>&quot;The very first thing University of Washington Center for Information Assurance and Cybersecurity (accredited by U.S. Department of Homeland Security, whatever that means) teaches you about becoming a CIO is precisely delegating responsibility :)&quot;<p><a href="http:&#x2F;&#x2F;depts.washington.edu&#x2F;ciac&#x2F;" rel="nofollow">http:&#x2F;&#x2F;depts.washington.edu&#x2F;ciac&#x2F;</a>