Information Security Handbook

Risk management is an organization-wide activity

Managing information security risk is a highly complex activity that requires the information security professional to be actively involved in all facets of the organization, from top-level organizational leadership down to the people, processes, and technology that makes the organization's mission successful:

The information professional must establish a risk management strategy whereby an organization can establish repeatable mechanisms for the ongoing assessment, response, and monitoring of information security risks. This allows the information security professional to engage the organization ...