The use of risk management frameworks (RMF) for managing enterprise/
organizational risk has been prevalent for years. More recently, the framework
approach has been applied to security risk management, and even more
recently, specifically to software/application security risk management.