ogy for identifying who is responsible for each information asset and the scope of each information asset owner's responsibilities. That information asset owner is Video Communications: The Whole Picture responsible for establishing and reviewing the asset's classification, confirming that adequate security controls are in place, establishing and confirming appropriateness of access rights, determining the asset value, and mandating backup requirements. Security Management Practices are the structure by which an organization determines its guidelines and operating procedures. The general security policy is the starting point for the various security policies that regulate file storage, data encryption, change management, backup and recovery, separation of responsibilities, access, auditing and testing, virus checking, and ongoing management. Top officials should demonstrate the importance of information security, and support efforts to formalize security management practices. Those practices are the foundation upon which the organization will build its information security strategy. Law, Ethics, and Investigation As important as any of an organization's assets is its ethical conduct. Ethics compel organizations to treat employees equally. If an organization accuses an employee of improper conduct, it must demonstrate that it is not singling out that employee. It must demonstrate that any monitoring of employees is a part of well-known and consistently-practiced policies and operating procedures. If an organization believes anyone to be guilty of a crime, it must follow procedures regarding search and seizure, hearsay evidence (computer-generated evidence is often considered hearsay evidence), and chain of custody. Moreover, an organization should specify procedures for returning confiscated assets. Risk Assessment The basic business case for video communications is to support of the organization's business model. To be clear, video communications support the business model, not vice versa. The purpose of informat