Abstract. Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity, and availability of IT resources. As systems become more complex and diverse and attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security risk. This paper describes a two-pronged approach in addressing IT security risk and risk management in the organization: 1) an institutional enterprise approach, and 2) a project life cycle approach. The institutional approach addresses automating the process of providing and maintaining security for IT systems and the data they contain. The project life cycle approach addresses providing semi-automated means for integrating security into the project life cycle. It describes use of a risk tool, the Defect Detection and Prevention (DDP) tool developed at the Jet Propulsion Laboratory, to manage risks. It also describes project and institutional mitigation processes and tools.