Here's a short video on the basics of information security for end-users.  A good somewhat entertaining way to spread the security gospel.

Budgets are constrained, and information technology is generally considered a below-the-line operational/cost center.  By leveraging a best-practice control framework, and consolidating regulatory efforts, organizations can leverage their regulatory budgets towards maturing their information posture, instead of pouring money down auditor gullets without reward.

 I recently gave a presentation at the Security Practitioner's Conference on this topic.  Here's a copy of my IT Optimizaiton & Risk Management slidedeck- enjoy!