Security is an underestimated risk to corporate success (or even in some cases, survival). Among the salient points are:

• Security is an ongoing process, not a state of affairs, a set of policies, or a product.

• IT security is an organic part of an integrated enterprise security strategy and cannot be effective in the absence of appropriate security regimes for physical assets, staff, intellectual property, and so on.