Think of all the planning, resource allocation, and tactical decisions managers face in building a more effective information security management system (ISMS). And complexity scales with the size of an organization; just identifying all the assets that require risk mitigation protection can represent a major undertaking. Organizations should seriously consider building a planning and decision-making methodology as the chief vehicle for transporting themselves from ISMS mediocrity to excellence.