premise: Initiating discussions on information security risks with business managers and conducting defined risk assessment procedures.
hypothesis: We are initiating discussions about IT risks with managers, since it is the biggest threat our business faces.