A thing that doesn’t apply to information security