Like bad weather, information security risks are here for the duration. Maintaining the stance of constant vigilance against persistent threats to information assets requires an information security management structure more disciplined, more organizationally embedded, and, generally, more effective than what some companies have today. In other words, these companies should consider an information security management methodology.