It is generally recommended that information security controls be selected and implemented according and in proportion to the risks, typically by assessing the threats, vulnerabilities and impacts.
Umumnya direkomendasikan bahwa kontrol keamanan informasi dipilih dan diterapkan sesuai dan sebanding dengan risikonya, biasanya dengan menilai ancaman, kerentanan dan dampaknya.