A university's central security group had developed a database that served as a valuable management tool in monitoring problems, reassessing risks, and determining how to best use limited resources to address the most significant information security problems.