MINISTRY OF SCIENCE, TECHNOLOGY AND TELECOMMUNICATIONS Specific Objective 6: Risk Management  Promote the implementation of a risk management model adapted to the own needs of each institution or organization. At managerial level of any organization, the adoption of a risk management process is basic for the review of important risks related to information technologies, which could occur regularly, and which would provide a consistent approach in the appropriation of this operation. Many entities have problems and deficiencies in that area; consequently there is no evaluation, measurement, nor adequate communication of the extent in which their operations are being affected by cybernetic attacks; nor the operations forwarded to build their cybernetic resilience. This understanding is essential to be able to effectively approach cybernetic risk. An effective cybernetic security regime adopts or develops a framework with a continuous cycle of risk evaluation activity, risk control, development of general security policies, business continuity guarantee, allocation of responsibilities, promotion de awareness and follow-up of the effectiveness of controls implemented. Business Continuity planning is a proactive measure ensuring that in case of emergencies, system failures or disasters, it is possible to recover and keep up the normal business functions in case some serious risk occurs. Uncertainty is a central theme on Information Technologies Risks and consequently the implementation of the best management practices is required. 40 Thus, the Software Engineering Institute Risk Management Model (SEI), the Federal Information Security Management (FISMA) Risk Management Framework and the ISO/IEC INTE 27000 norms, shall be taken in consideration, among others. Strategic Line 6.1 Improve the security of products and services associated to information security.  Promote the implementation of security norms for the operation of public and private organizations as a matter of priority, taking into account the international rules such as Tripton, H. y Krause, M. (2004). Handbook of Information Security Management. USA: CRC Press. Available: http://index-of.co.uk/Computer-Security/CRC%20Press%20%20Information%20Security%20Management%20Handbook,%20Fifth%20.pdf 40 - 44 www.micitt.go.cr