Security through Information Risk Management
M. Eric Johnson, Eric Goetz, Shari Lawrence Pfleeger · IEEE Security & Privacy · 2009
Managing information risk means building risk analysis into every business decision. Chief information security officers widely agree that action plans must include risk categorization, communication, and measurement.