This approach ensures that the operation of IT system and software does not present undue risk to the enterprise and its information assets. Supporting activities include risk assessment; risk mitigation; security control selection; implementation and evaluation; and software security standards compliance.