Good information security does not just happen--and often does not happen at all. Resources are always in short supply, and there are always other needs that seem more pressing. Why? Because information security is hard to define, the required tasks are unclear, and the work never seems to be finished. However, the loss to the organization can be devastating if confidential information is compromised or networks become unavailable when communication channels become overloaded with virus and worm traffic. Some of the challenges are chronic; for example, universities face the regular influx of students whose personal equipment has poorly maintained security protection. Other problems are opportunistic, such as when a researcher loads patient data on a poorly protected machine, the information is compromised, and someone uses it inappropriately. One of the key fiduciary roles of management is protecting the assets of the organization. "Organizational asset" refers to the means by which the organization creates value for its stakeholders, and those assets include information assets. In this article, the authors discuss information security which is a growing challenge for every organization. Effective organizational data stewardship, initiated from senior management and permeating all levels of the organization, is needed to motivate everyone in the organization to provide a high degree of due diligence. Anything less risks disaster. (Contains 1 figure, 2 endnotes and 8 online resources.)