https://www.sans.org/reading-room/whitepapers/riskmanagement/framework-innovative-security-decisions-36422