In addition, there are many aspects of information security, such as risk assessment, policy development, and disaster recovery planning, that require coordinated management attention.
Risk assessment is part of information security.