Both of these factors tend to be situational in nature, as every organization faces its own unique challenges and
risk based on the nature of its business. Business environment in particular tends to drive risk decisions. For
example, a small start-up company may be much more tolerant of risk than a large, well-established corporation.
Therefore, it can be helpful to reference these broad criteria when evaluating the drivers affecting the security of a
specific organization.