Premise: In this regard, agencies must continually (1) explore and assess information security risks to business operations, (2) determine what policies, standards, and controls are worth implementing to reduce these risks, (3) promote awareness and understanding among program managers, computer users, and systems development staff, and

Hypothesis: There is no risk to business operations, so no reason to try and asses or control them.
Relation: contradiction