For information security, as with other types of internal controls, these views and requirements generally flow directly from risk considerations, as illustrated in the management cycle depicted above.
The management cycle depicts views and requirements flowing from a state of anarchy.