text: In this regard , agencies must continually ( 1 ) explore and assess information security risks to business operations , ( 2 ) determine what policies , standards , and controls are worth implementing to reduce these risks , ( 3 ) promote awareness and understanding among program managers , computer users , and systems development staff , and
  
  ###
  
  There is no real way to control the risks 100 % but there always will be ways to help diminish them .