What is information assurance? I have my own idea. Do you have yours?

Wikipedia starts their coverage with this definition: “Information Assurance (IA) is the practice of managing information-related risks. More specifically, IA practitioners seek to protect the confidentiality, integrity, and availability of data and their delivery systems. These goals are relevant whether the data are in storage, processing, or transit, and whether threatened by malice or accident. In other words, IA is the process of ensuring that the right people get the right information at the right time.”

I suppose that’s okay. It doesn’t really match my own mental map of Information Assurance, though. When I think of Information Assurance, I think of a strategic, board level initiative that commits an organisation to certain principles. These principles are implemented through correct practice of certain disciplines, such as identity management, information security, business continuity, data privacy laws and regulations, etc. These disciplines are enabled by technologies, such as biometrics, database management and protection, correct software development practices, etc. Actually, it may not be that different to what Wikipedia writes later in its page on the subject, ‘a superset of information security’ issues.

How close is this to your views on information assurance?