The Risk management process is a closed loop, or iterative provides a feedback mechanism for continuous process improvement. ISO17799-3 Standard addresses the application side of the process as an Information Security technique.
Nature of Business Risk maybe
- Operational- Operational Risk is concerned with the ability to implement the tactical risk-based control objective (such risk are budget, technology, and timelines
- Strategic - Strategic Risk is risk to profit or organizational existence and may not be of any importance to Information Security
- Tactical -Tactical Risk is risk to the Information Security program ability to mitigate relevant strategic risk to information
