Title: Recommended Risk Control Practices
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Recommended Risk Control Practices
1. Planned expenditures to implement a control strategy must be justified and budget authorities must be convinced to spend the necessary amount to protect a particular asset from an identified threat.  Unfortunately, most budget authorities focus on trying to cut a percentage of the total figure to save the organization money.  This underlines the importance of developing strong justifications for specific action plans and providing concrete estimates in those plans.
2. Another factor to consider is that each control or safeguard affects more than one asset- threat pair. Information security professionals manage a dynamic matrix covering a broad range of threats, information assets, controls and identified vulnerabilities.
3. If a new safeguard is implemented, there is a risk decrease associated with all subsequent control evaluations.  To make matters even more complex, the action of implementing a control may change the values assigned or calculated in a prior estimate.
4. There is an ongoing search for ways to design security architectures that go beyond the direct application of specific controls in which each is justified for a specific information asset vulnerability, to safeguards that can be applied to several vulnerabilities at once.