anchor: For information security, as with other types of internal controls, these views and requirements generally flow directly from risk considerations, as illustrated in the management cycle depicted above.
positive: These views and requirements bear some relationship to risk considerations.
negative: The management cycle depicts views and requirements flowing from a state of anarchy.