text: The executive will have met this element by ensuring that information system security plans exist and are implemented in accordance with the National Institute of Standards and Technology and Office of Management and Budget guidelines ; ensuring that annual risk assessments are conducted for each identified information security-applications , hardware , software-to ensure that the identified risks , vulnerabilities , and threats are addressed by appropriate security controls ; and ensuring that all employees comply with departmental training requirements to understand their information security responsibilities .
  
  ###
  
  The executive will meet that element .