The answer is: Be cost-effective, support the mission of the organization, requires a comprehensive and integrated approach
The nist sp 800-14 filled with the general Expectation that must be filled for an information technology system to be sued by a private corporation or government agency. cost-effective and comprehensiveness will ensure that the benefit from using the technology will outweigh the cost
