In many states, the top information security officer champions IT security rather than dictates it, as the decisions of specific steps to take to safeguard digital assets are left to departments, agencies and commissions.