Therefore, any organization connected to the Internet should consider some degree of protection for online information resources. Organizations need to reduce the chances of attack or misuse while minimizing its impact should a security incident occur.
Different organizations have different risk management needs.
Therefore, each risk management program must match a company's level of business maturity and the level of inherent risk in loss or damage of the information being protected. For example, a small online retailer has significantly different requirements than a large, multinational bank. Emerging Businesses Smaller organizations, usually outsourcing web hosting and other online operations to an outside party. Frequently startups with a limited number of Internet addresses. Limited budgets, with almost no money allocated to security.