A CISO has recently joined an organization with a poorly implemented security program. The desire is to base the security program on a risk management approach....