Comprehensive Coverage – The gist of this methodology is to review the information system and identify the information assets. For the assets in the system identify where they are relative to the following states: transmission, processing and storage. For each of these states, give consideration to the confidentiality, integrity and availability (CIA) needs for the business. This matrix will output a qualified risk value for the assets. The implementer then utilizes technology, human factors and policies and procedures to mitigate the risk.The information will always be in one of the 3 states, and the CIA security characteristics are fundamental in our industry. By giving each state/characteristic combination fair consideration, a comprehensive coverage of all the security needs are performed. All too often availability is quickly assumed with a backup strategy, but by giving the topic a fair turn at the table, unexpected delays and outages due to a simple malfunction can be avoided.