Who is the decision maker in IT company?

Usually the Department that handles the Data Security would dictate what is to be used to ensure the corporate data is secure in all aspects.

They would work as a team with the Network Infrastructure Department who would setup the dictated Anti Virus and Certificate Authority decided upon by Data Security.

Thanks for your reply!

My question was mostly about a physical person who is a decision maker, and not about the department that handles those kind of matters. I've heard about these positions:
IT director;
information systems manager;
chief information officer;
CTO (chief technology officer);
chief technical officer.
And the second part of my question is whether CEO is involved in the process or it's not kind of issue he might be interested to interfere in?

Ultimately, it depends on the business and, for small to medium business', in general, the owner's preference.

-saige-

The CIO is always informed and consulted on what takes place in the organization's Information Technology Infrastructure as he is the one that has to answer to anything that might happen within it.

But because Technology is so vast and complex it requires a team to work together to decide upon and recommend what needs to be implemented.

So depending on the Company Size and How it is organized in it's infrastructure for handling the various aspects of the business would determine what people need to be involved and informed about what is taking place within a Company.

Without Knowing the details of the said company and what it's organization chart looks like it is very difficult to give you a complete answer.

Wes Miller, thanks for your input!
Okay, let me somewhat correct my question to make it more answerable. Let's say that your company uses AV that costs the company $300/year. And the salesperson/marketer has approached your CEO with a proposal to use another good AV suite for $200/year. In such a case, what probably CEO would do -- make his own decision or pass it down to his IT staff?
OR... if that same salesperson/marketer has approached CIO, would he (the CIO) even bother to notify his boss about the matter or he would simply say no in order to lessen the workload on his IT Department? After all, why would CIO care about the finances? Or I'm wrong in my assumption?

Depends on amount also for the approving party. in general, the CIO should be able to decide that in consultation with CISO or its delegate CTO as oversight. There may be a Chief Staff Advisor  at time as second leadership for bigger group. for info