. . . "In information security, management systematically evaluates risks of all types and determines the cost of mitigating the risk or the consequence of accepting or ignoring the risk." .