The responsibility for establishing and maintaining information security today looks like a Scrabble board. COSO, COBIT, ITIL, ISO, and ASIS¹ (apologies if I missed any other tiles) are either standards bodies that evangelize practices or acronyms for the management practices themselves -- all designed to help organizations optimize today's information security strategy and contend with tomorrow's threats. Whatever approach an organization adopts, there is one other standard worth considering first.