Goals, scope, and objectives of the information risk management program were applied in the typical case by empowering business owners to manage risks with the security team playing a supporting role as policymakers and overseers, making security everyone's problem.