When reviewing the risk management process at a newly formed organization, the information security professional notices that all the steps have not been considered as part of the process. The process includes framing and responding but should also include