Physical, network, system and data security - organizational question

I apologize for cross-posting this to the two mailing lists, but I hope to 
gain your (and moderator's ;)) understanding for having done so. Here are the 
issues I am confronted with:

- what is the best methodology to organize security, in regards to combining 
physical (now under administration management - i.e. surveillance and 
recording equipment, time/badging systems, B(uilding)A(utomation)S(ystems)) 
with the IT one (now, obviously, under IT control), knowing that more and 
more of the former is being carried out over the network, and tied into 
back-end IT systems, while also requiring IT expertise from the security 
people. I am interested in the hierarchy of report-to-s, also, all the way up 
to ... who would be that person?!?

- are there any guiding principles, best practices, legal documents and/or new 
requirements addressing this aspect (the organizational aspect)

- considering the costs of the ISO 17799 toolkit ($995), could someone on 
either mailing lists advise on whether investing in this would provide 
answers to what I am looking for?!?

Thank you,
Stefan