▁compared ▁to ▁W . ▁Edwards ▁Dem ing ' s ▁Qu ality ▁Circle ▁( Plan , ▁Do , ▁Check , ▁Act ). ▁ ▁The ▁inputs ▁are ▁requirements ▁from ▁clients . ▁The ▁requirements ▁are ▁translated ▁into ▁security ▁services ▁and ▁security ▁metrics . ▁Both ▁the ▁client ▁and ▁the ▁plan ▁sub - process ▁affect ▁the ▁S LA . ▁The ▁S LA ▁is ▁an ▁input ▁for ▁both ▁the ▁client ▁and ▁the ▁process . ▁The ▁provider ▁develop s ▁security ▁plans ▁for ▁the ▁organization . ▁These ▁plans ▁contain ▁policies ▁and ▁oper ational ▁level ▁agre ements . ▁The ▁security ▁plans ▁( Plan ) ▁are ▁then ▁implemented ▁( Do ) ▁and ▁the ▁implementation ▁is ▁then ▁evaluated ▁( Check ). ▁After ▁the ▁evaluation , ▁the ▁plans ▁and ▁the ▁plan ▁implementation ▁are ▁maintained ▁( Act ). ▁ ▁The ▁activities , ▁results / products ▁and ▁the ▁process ▁are ▁documented . ▁External ▁reports ▁are ▁written ▁and ▁sent ▁to ▁the ▁clients . ▁The ▁clients ▁are ▁then ▁able ▁to ▁adapt ▁their ▁requirements ▁based ▁on ▁the ▁information ▁received ▁through ▁the ▁reports . ▁Furthermore , ▁the ▁service ▁provider ▁can ▁adjust ▁their ▁plan ▁or ▁the ▁implementation ▁based ▁on ▁their ▁find ings ▁in ▁order ▁to ▁satisfy ▁all ▁the ▁requirements ▁stated ▁in ▁the ▁S LA ▁( including ▁new ▁requirements ). ▁ ▁Control ▁ ▁The ▁first ▁activity ▁in ▁the ▁security ▁management ▁process ▁is ▁the ▁“ Control ” ▁sub - process . ▁The ▁Control ▁sub - process ▁organ izes ▁and ▁man ages ▁the ▁security ▁management ▁process . ▁The ▁Control ▁sub - process ▁defines ▁the ▁processes , ▁the ▁allocation ▁of ▁responsibility ▁for ▁the ▁policy ▁statements ▁and