GAO report, on the highlights page, there is a suggested that there are six essential elements of Enterprise Risk Management. But your readings show that in many ISO models – not just cybersecurity, but quality assurance, environmental, and others – ISO suggests a 4-step process called Plan-Do-Check-Act. For this week’s discussion, consider the degree to which the ISO and GAO models are two statements of the same process or are different. If different, how? If the same, what do you see as the advantages or disadvantages of these views of the same underlying requirements?