As security becomes an increasing concern, techniques for risk analysis are again rising to the fore. The IT department faces risk in several different areas. Although widely associated with backup and recovery strategies, risk is also incurred in a variety of other business decisions, particularly in activities such as development, outsourcing, and implementation of new technologies or new services, where there is a defined satisfactory outcome and potential penalties in the event of failure.