premise: For information security, as with other types of internal controls, these views and requirements generally flow directly from risk considerations, as illustrated in the management cycle depicted above.
hypothesis: The management cycle depicts views and requirements flowing from a state of anarchy.