This case study details how Entrust incorporated Information Security Governance into its corporate governance process. Best practices and lessons learned are presented to help organizations recognize the ROI in managing information security as a corporate responsibility, instead of a technology challenge.