“Information technology (IT) assets must be protected from external and internal activities detrimental to effective and efficient functionality.”