9. Who is expected to be engaged in risk management activities in most organizations? 10. What are the basic strategies used to control risk? Define each. 11. What is a contingency plan? 12. List and describe the four subordinate functions of a contingency plan. 13. In general terms, what is policy? 14. What is the enterprise information security policy, and how is it used? 15. Why is shaping policy considered difficult? 16. What are standards? How are they different from policy? 17. What is an issue-specific security policy? 18. List the critical areas covered in an issue-specific security policy. 19. What is a systems-specific security policy? 20. When is a systems-specific security policy used?