This paper describes the implementation of an information security program at a large Midwestern university. The initial work is briefly summarized and improvements that have occurred over time are described. Current activities and future plans are discussed. This paper offers insight and lessons learned for organizations that have or are planning to implement an information security program. Some key success factors for this program have been a faculty project champion, faculty dedication and tenacity, involvement with industry partners, alumni, and students, and continuous improvement. (Contains 1 table and 5 figures.)