Which of the following areas of capability are covered by IT Security Risk Management?

Establishing security policies and standards, testing Business Continuity Plans

Establishing business context for security, detecting and responding to attacks

Developing Plans of Action & Milestones, managing Crisis Events

Identifying and meeting regulatory obligations, defining and implementing policies and standards