▁and ▁information ▁processes ▁( not ▁just ▁IT ). ▁It ▁is ▁designed ▁to ▁align ▁with ▁and ▁support ▁information ▁security ▁risk ▁management ▁according ▁to ▁ISO / IE C ▁ 2 7 0 0 5 , ▁particularly ▁in ▁the ▁context ▁of ▁an ▁ISO / IE C ▁ 2 7 0 0 1 - comp li ant ▁Information ▁Security ▁Management ▁System ▁( IS MS ) ▁or ▁a ▁similar ▁over arch ing ▁security ▁management ▁or ▁govern ance ▁framework . ▁ ▁History ▁ME H AR I ▁has ▁stead ily ▁evol ved ▁since ▁the ▁mid - 1 9 9 0 s ▁to ▁support ▁standards ▁such ▁as ▁ISO / IE C ▁ 2 7 0 0 1 , ▁ISO / IE C ▁ 2 7 0 0 2 , ▁ISO / IE C ▁ 2 7 0 0 5 ▁and ▁N IST ' s ▁SP ▁ 8 0 0 - 3 0 . ▁The ▁current ▁version ▁of ▁ME H AR I ▁Ex pert ▁( 2 0 1 0 ) ▁includes ▁links ▁and ▁support ▁for ▁ISO ▁ 2 7 0 0 1 / 2 7 0 0 2 : 2 0 1 3 ▁revision ▁IS MS . ▁ ▁Description ▁ME H AR I ▁Ex pert ▁( 2 0 1 0 ) ▁comb ines ▁a ▁powerful ▁and ▁extend ible ▁knowledge ▁base ▁with ▁a ▁flexible ▁suite ▁of ▁tools ▁supporting ▁the ▁following ▁information ▁security ▁risk ▁analysis ▁and ▁management ▁activities : ▁▁ ▁Th re at ▁analysis : ▁top ▁business ▁man agers ▁describe ▁the ▁organization ' s ▁activities , ▁list ▁the ▁potential ▁issues ▁or ▁concerns ▁that ▁might