InfoSec Risk Management isn't rocket science but unless embedded throughout an organisations governance structure and then used to inform strategic decision making, it's basically shelfware.

This blog post is here to help folks avoid common pitfalls.