anchor: In this regard, agencies must continually (1) explore and assess information security risks to business operations, (2) determine what policies, standards, and controls are worth implementing to reduce these risks, (3) promote awareness and understanding among program managers, computer users, and systems development staff, and
positive: Agencies have to find ways to reduce these risks, either by implementing some kind of policies, by promoting awareness and by assessing the security risks present in their business operations.
negative: There is no risk to business operations, so no reason to try and asses or control them.