Organization and spending -- Patterns of organization -- Security directors -- Risk managers and IT security officers -- Accountability is widely dispersed -- Salary levels -- Staffing levels -- The chief security officer position -- Authority and financial resources -- Changes in accountability -- Case study: Emergency response at Duke Energy -- Creating the CSO position -- Spending on corporate security -- A permanent increase in spending -- A modest increase overall -- Case study: Consolidating security at Avaya -- Security spending in the Northeast -- Smaller companies bear a larger burden -- The cost of IT security -- Case study: IT security at Unisys -- The soaring cost of risk management -- Changes in insurance coverage -- Risk management as a line item -- A methodological note on risk management data -- The costs of terrorism -- What security executives worry about -- The desirability of dispersing facilities -- Case study: Crisis management at Air Products -- Threats to IT security -- Lessons learned.