in the early 1980s, organizations began to recognize that connected pcs in various locations were much more vulnerable than a mainframe locked away in a single building. these organizations began seeking qualified individuals responsible for selecting, recommending and implementing security policy and procedures. however, few schools were offering information security curricula, much less academic degrees, and organizations would have to take an it professional at his or her word that they knew how to manage information security for the entire enterprise.