.???(11) The term ???risk-based security??? means security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to, or modification, of information, including assuring that systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability.