Also, Security is not IT. That's another thing that needs to change.

Do you mean that

    Security is not currently IT and it should be

or do you mean

    Security is considered to be IT and it shouldn't be

? The amount of stress that you mean to put on the word "not" doesn't come through very well in this medium.