As a standalone program, the act of performing risk management is a fulfilment of regulatory compliance. However from a holistic information security management perspective, it demonstrates that the Management is driven by the minimum level of institutional forces (i.e. regulative). This level will only enable the Management to drive a compliance-based security culture within the Organization. Compliance-based security culture is primarily built on lagging indicators and is reactive in nature, which is insufficient to combat the wave of cybersecurity and information security threats today. Management need to step up and proactively lead the Organization foster a cultural-cognitive based security culture and edging towards a generative security culture maturity level.

Security culture can be built through a combination of correct implementation of frameworks institutionalized within the Organization and one of the main pillars would be the risk management framework. Besides providing assurance to the authorities and public communities that proper due diligence has been carried out to reduce uncertainty in business operations, the risk management framework should encourage the participation of the operational staff identifying risks that may affect their performance and the mitigating efforts invested, communicating the risks to the Management, sharing of knowledge and best practices among staff as well as getting staff to be responsible for their role to operationalize security practices. This outcome will drive sustainable risk management program to upkeep the quality and currency of risk management performed. 

Maximus believes that everything in existence possesses an inherent set of vulnerabilities. Things of the same category would have an identical set of vulnerabilities. For example, humans inherently carry an observable risk of falls because we are bipedal and applications inherently carry a risk of being remotely exploited because it accepts requests from a sender to perform a task. Every vulnerability can be mitigated with a standard set of controls for things of the same category.

Depending on the risk discipline (e.g. cybersecurity), things of relevance may be a business process, application, operating system, physical infrastructure or an engaged outsourced service. While thing of relevance may bring benefits to the Organization, it may fall short of expectation after some time or be successfully exploited by bad actor. The antecedent for such consequence is the threat. While threats may be quite static in nature, threat events evolves over time. An example of a threat would be a malware attack, convention threat events would be sending file attachments with malware embedded but recently, the new threats would be embedding malware in PowerShell scripts.

According to risk management literature, each threat or threat event needs to exploit the vulnerability to form a risk, which in turn has a set of controls for risk mitigation. However, the main difference is that while all controls in the respective vulnerabilities may be applicable for a threat, not the same can be said for threat event. Threat events are generally more specific and trending in nature and hence, only certain controls may deem to be applicable for mitigating a risk.