I. Critique the reality that risk management is a cyclical event that is fundamental to the information security program and requires continuous improvement.
II. Examine that the principal goal is to protect the organization while the ability to perform its mission remains untouched.
III. Recognize that risk management carries through the entire process of the SDLC, and no one step is excluded from it.