Information security is an increasingly important institutional issue that is not just the responsibility of the CIO - it is everyone's responsibility.