acknowledgments I would like to thank Jones & Bartlett Learning for the opportunity to write this book and be a part of the Information Systems Security & Assurance Series project. I offer my deep appreciation to Kim Lindros, who did an excellent job coordinating this book despite many challenges. Her guidance, patience, and support were instrumental to its success. A special thank-you goes to Mike Chapple, whose experience and debate on risk topics was helpful. His thought-provoking challenges were much appreciated. Thanks also to Mark Merkow and Darril Gibson for contributing chapters to this book. I would also like to thank the staff and volunteers at ISACA, who dedicate themselves to providing global thought leadership to help define best practices for information audit, security, and risk management. Special thanks to Joann Skiba and Robert Bergquist, who helped facilitate access to ISACA IP material. Special thanks goes to John Pironti, IP Architects, LLC, who is a true professional in the field in every sense of the word. His willingness to share his deep experiences at all hours of the night was very helpful. My gratitude to Gary Dickhart, SAP, who passed on lessons to me over the years on driving for high-quality results and never forgetting about compassionate management. His lessons on teamwork and motivation are insightful. Additional thanks to a myriad of friends and supporters at E&Y and KPMG who offered suggestions and insights. The caliber of these professionals is amazing, and the experiences they shared extremely valuable. --Rob Johnson Thank you to my family, who always support me when I need them the most, and thanks to my colleagues at PayPal Inc., who define excellence in putting information security to work! --Mark Merkow xvii