In this regard , agencies must continually ( 1 ) explore and assess information security risks to business operations , ( 2 ) determine what policies , standards , and controls are worth implementing to reduce these risks , ( 3 ) promote awareness and understanding among program managers , computer users , and systems development staff , and
Agencies have to find ways to reduce these risks , either by implementing some kind of policies , by promoting awareness and by assessing the security risks present in their business operations .