Government reports document that information assurance (IA) security practices place commercial businesses in a vulnerable position. Presidential reports identify IA as a high-risk area needing immediate attention. The problem addressed in the study was IA policies and practices in commercial businesses lack a standard of practice which poses a threat to commercial business IT databases and infrastructures. Drawing from the change management theory, the purpose of the study was to determine the extent to which IA in commercial businesses was standardized and the impact it has on public trust of private information. The research questions focused on the types of IA standards, training, and years of experiences for security professionals currently being applied and used in a commercial IA position. Identification of IA policies and training was compared across all sizes of commercial companies from small to large. Descriptive statistics, Chi-square and, correlation analyses revealed that IA policies are not standardized across the industry and IA professional training was not a prerequisite for position held. Implications for social change include implementing IA awareness training strategy and professional development into all businesses. Implications for social change include increased commitment to IA awareness training and professional development that could help improve information security and thus consumer confidence.