I really believe that information security is about the business and we need to bring the business together, specially when doing risk management.