For information security, as with other types of internal controls, these views and requirements generally flow directly from risk considerations, as illustrated in the management cycle depicted above.
These views and requirements bear some relationship to risk considerations.