Companies that have developed world-class information security programs have all accomplished their goals via focusing on security from a framework of risk mitigation.