The company’s Enterprise Risk Management program also has a role in governance of the Information Security program, working with Information Security management to facilitate performance of Risk and Control Self Assessments, the results of which are included in Board Risk Committee metrics.