Problem
Describe the risk assessment process and how to design response plans. Why does information security use a top-down approach? How does senior management impact the risk assessment and response plans? What is the result of IT being tasked with designing the plans but not having senior management support?