This paper presents the results of an empirical investigation concerning the approaches adopted by Italian companies in dealing with information security issues. Such results are compared to an ideal, integrated information system planning approach where information needs and risk management are...