$ 0 0 Enterprises need a formal risk assumption model which clearly states who can assume security risksOrange