All of the organizations studied had reoriented their security programs to make them visible, integral components of their business operations. The GAO study findings have been published in an exposure draft executive guide entitled, Information Security Management, Learning from Leading Organizations . After reviewing the comments that it received on the exposure draft, GAO plans to issue a new version of the executive guide. Risk Management Risk management is the process of assessing risk, taking steps to reduce risk to an acceptable level, and maintaining that level of risk. A risk management process for information systems enables managers and their organizations to build an in-depth knowledge about their systems and how they are interrelated.
Risk management is a vital element of a comprehensive information security program.
The successful organizations applied these principles by linking them into a cycle of activity that enabled the organizations to address risks on an ongoing basis. The success of security programs depended upon the recognition and understanding of the senior executives that their information systems were subject to risks and that these risks affected their business operations. After assessing risks of their business operations, the organizations established policies and selected controls. They emphasized increased awareness of users to the policies and controls. They monitored the effectiveness of the policies and controls and used the results to determine if modifications of policies and controls were needed.