Reduced Resource Commitment – The methodology is not a process that needs to be replicated on a recurring basis; it is a methodology to use in the assessment and design phases of the security program. Invoking the use of the methodology is called for when the information systems environment is significantly changed.Given the information-centric approach, an example (that is not a technology change) includes the recent passage of the Mass 201 CMR 17.00 law[4]. This law requires Massachusetts businesses to appropriately protect personal identifying information from unauthorized disclosure (data breach). This law changes the value of these information assets for businesses, requiring a reassessment to occur, to insure an appropriate amount of security measures are leveraged to mitigate risk.