"Data is becoming an asset which needs to be guardedas much as any other asset," says Haim Mendelson of Stan-ford University's business school. "The ability to guard cus-tomer data is the key to market value, which the board is re-sponsible for on behalf of shareholders." Indeed, just asthere is the concept of Generally Accepted Accounting Prin-ciples （GAAP）, perhaps it is time for GASP, GenerallyAccepted Security PraCtices, suggested Eli Noam of NewYork's Columbia Business School. "Setting the proper in-vestment level for security, redundancy, and recovery is amanagement issue, not a technical one. " he says.