Adress the way risk management affects the way an organization implements an Information Security program
