The first step when adding a website to IIS is to configure the application pool that it will run in. This isolates the site from others on the server for better stability and security. On the stability front, each app pool runs its own worker process that, should it die or be taken offline intentionally, won't affect the others. As for security, you can customize the user account that the app pool process runs as. This way, you can give one website more or less access than another.