Mechanisms exist to isolate security functions from non-security functions.
Does the organization isolate security functions from non-security functions?