In this regard, agencies must continually (1) explore and assess information security risks to business operations, (2) determine what policies, standards, and controls are worth implementing to reduce these risks, (3) promote awareness and understanding among program managers, computer users, and systems development staff, and
Agencies have to find ways to reduce these risks, either by implementing some kind of policies, by promoting awareness and by assessing the security risks present in their business operations.