The Information Security Office can be a business enabler