We sympathize with IT departments. They are often overworked trying to 'keep the lights on' - keeping the existing systems going and working on new technology projects. It is simply not practical for the IT department to oversee all aspects of cyber security but IT does play a very critical role in the operational components of cyber security.