It is pretty reasonable to say that managers need to have at least a cursory understanding of the business they are managing. That doesn't mean anyone expects

It is pretty reasonable to say that managers need to have at least a cursory understanding of the business they are managing. That doesn't mean anyone expects a president to take a direct hand in selection of components for a security infrastructure, but rather have an appreciation that information security is quite serious and put competent managers in place over those decisions. Even a Director level position in any location in government is still rather far removed from the decision process as their purview typically includes HR, budgeting, procurement, regulatory oversight, and somewhere further down the pole is the actual work. That isn't naivete but reality of how this bureaucracy works.