In this regard , agencies must continually ( 1 ) explore and assess information security risks to business operations , ( 2 ) determine what policies , standards , and controls are worth implementing to reduce these risks , ( 3 ) promote awareness and understanding among program managers , computer users , and systems development staff , and
There is no real way to control the risks 100 % but there always will be ways to help diminish them .