Each administrative department has received a Department Security Plan that includes a risk assessment. The risk assessment has a list of industry standard security controls that a department is advised to implement. Each control is given a score based off its level of implementation by the department. The final risk score is the average score of each control.