premise: For information security, as with other types of internal controls, these views and requirements generally flow directly from risk considerations, as illustrated in the management cycle depicted above.
hypothesis: These views and requirements bear some relationship to risk considerations.