Formulate risk approaches that can deal with complex systems and also systems distributed across multiple locations and platforms $($e$.$g$.,$ computing and foreign offices, tight integration with suppliers and$/$or customers$).$

Support diverse capabilities of the different systems and increased risks in cases when systems are not fully owned by the case study organization.

Consider those systems that are accessed by people that do not work for the organization and a variety of approaches used in various locations and levels.

Apply specific risk metrics as a means of quantifying risk resilience