Educause’s 2016 report puts Information Security at the top of the list.
Lots of reasons, but here’s one that stands out (other than the well publicized breaches): “Only 27% of U.S. institutions have an information security policy that is fully approved by leadership.”
This ECAR infographic tells the story.