including for operational risk. Fund managers employ various strategies to protect their fund value; these given their mandate and benchmark. Non-financial firms focus on business risk more generally, overlapping enterprise risk management: i.e. those events and occurrences which could negatively impact cash flow or profitability, and hence result in a loss of business value or a decline in share price. Information technology In information technology, risk management includes "Incident Handling", an action plan for dealing with intrusions, cyber-theft, denial of service, fire, floods, and other security-related events. According to the SANS Institute, it is a six step process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Contractual risk management The concept of "contractual risk management" emphasises the use of risk management techniques in contract deployment, i.e. managing the risks which are accepted through entry into a contract. Norwegian academic Petri Keskitalo defines "contractual risk management" as "a practical, proactive and systematical contracting method that uses contract planning and governance to manage risks connected to business activities". In an article by Samuel Greengard published in 2010, two US legal cases are mentioned which emphasise the importance of having a strategy for dealing with risk: UDC v. CH2M Hill, which deals with the risk to a professional advisor who signs an indemnification provision including acceptance of a duty to defend, who may thereby pick up the legal costs of defending a client subject to a claim from a third party, Witt v. La Gorce Country Club, which deals with the effectiveness of a limitation of liability clause, which may, in certain jurisdictions, be found to be ineffective. Greengard recommends using industry-standard contract language as much as possible to reduce risk as much as possible and rely on clauses which have been in use and subject to established court interpretation over a number of years. Memory institutions (museums, libraries and archives) Enterprise security ESRM is a security program management approach that links security activities to an enterprise's mission and business goals through risk management methods. The security leader's role in ESRM is to manage risks of harm to enterprise assets in partnership with the business leaders whose assets are exposed to those risks. ESRM involves educating business leaders on the realistic impacts of identified risks, presenting potential strategies to mitigate those impacts, then enacting the option chosen by the business in line with accepted levels of business risk tolerance Medical devices For medical