Patent ID: 7703123

Claim:
A method for managing security, comprising: communicating, to a plurality of business groups in an organization, a set of security standards applicable to the business groups, each business group assigned to conduct business in a particular business field and controlled by a management party managing the entire organization; sending, from one or more computers, at least one deviation request from one or more of the business groups, wherein each deviation request comprises a proposed course of action that deviates from at least one of the security standards and also comprises a statement describing why the proposed course of action is beneficial for at least a part of the organization; receiving all of the deviation requests at a computer accessible by a security compliance party having authority to approve or deny any one of the deviation requests; for each deviation request received at the computer accessible by the security compliance party, determining, by the security compliance party, a benefit level associated with the proposed course of action to the organization based on the statement, said benefit level being determined by an analysis of positive consequences associated with implementing said deviation; a risk level associated with the proposed course of action to the organization based on a comparison of the proposed course of action to the set of security standards, and also based on any available risk mitigation measures that mitigates the risk level, said risk level being determined by possible negative consequences associated with implementing said deviation; and deciding, by the security compliance party, whether to approve or deny the each deviation request for implementation based on the determined risk level and the determined benefit level.