In my opinion, this paper is advocating for a risk-management approach to cybersecurity, just like businesses address every other issue. Evaluate the risks, in

In my opinion, this paper is advocating for a risk-management approach to cybersecurity, just like businesses address every other issue. Evaluate the risks, including cybersecurity, do what you can to reduce the probability or impact of any occurrence, and develop actionable plans to maintain business resiliency during and after any such event. This is what successful businesses do all the time. This is not revolutionary, it's just not an idea that's been applied on a widespread basis in the cybersecurity realm until fairly recently.