In this regard , agencies must continually ( 1 ) explore and assess information security risks to business operations , ( 2 ) determine what policies , standards , and controls are worth implementing to reduce these risks , ( 3 ) promote awareness and understanding among program managers , computer users , and systems development staff , and
There is no risk to business operations , so no reason to try and asses or control them .