One of the most important aspects of security organization is to establish a framework to identify security-significant points where policies and procedures are declared. The (information) security infrastructure comprises entities, processes, and technology. All are participants in handling information, which is the item that needs to be protected. Our approach is to identify information stream as the principal focus of security consideration, and it is based on recognizing points of transformation in the flow of information as the pivots around which security organization is built. The information stream model is a general, coherent blueprint of security organization without getting into details of specific technology, policies, or practices.