Determining the range of actions that an organization needs to take to reduce security risk to an adequate or acceptable level depends on what an organization needs to protect and what it needs to prevent. Consider the following questions from an enterprise perspective:

Determining the range of actions that an organization needs to take to reduce security risk to an adequate or acceptable level depends on what an organization needs to protect and what it needs to prevent. Consider the following questions from an enterprise perspective:

Editor's note: This Executive Update is excerpted from the Software Engineering Institute's Governing for Enterprise Security (©2005 Carnegie Mellon University). Permission has been granted to Cutter Consortium to reproduce.

Editor's note: This Executive Update is excerpted from the Software Engineering Institute's Governing for Enterprise Security (©2005 Carnegie Mellon University). Permission has been granted to Cutter Consortium to reproduce.

The quip to emerge from business process offshoring's growing prominence is this: if you want to avoid being laid off from offshoring, then become the person who manages all the offshoring initiatives in your organization. Surely someone has to hang around to turn off the lights at the end of the day.

The quip to emerge from business process offshoring's growing prominence is this: if you want to avoid being laid off from offshoring, then become the person who manages all the offshoring initiatives in your organization. Surely someone has to hang around to turn off the lights at the end of the day.