RWS's security risk management program is outlined in the Group Security Risk Management policy. This contains the methodology to be used for the identification and management of security risks, including: Asset Identification; Impact Analysis; Risk Assessment; Identification and Application of Controls; and Monitoring of Control Effectiveness. Risks are assessed periodically or when a significant change occurs that could have an impact on the confidentiality, integrity, or availability of RWS information or assets. Oversight and governance of the risk management processes is exercised by the Security Governance, Risk and Compliance Manager and Information Security Steering Committee as appropriate.