I highly recommend reading ETS, then 'Measuring and managing information risk', both talk extensively about this. Magoo has written quite a bit as well. I real

I highly recommend reading ETS, then 'Measuring and managing information risk', both talk extensively about this. Magoo has written quite a bit as well. I really appreciate the mission support oriented perspective in ETS, something a lot of security practitioners could learn from.