A strong information security program is a competitive gain not just a cost