We first collected some formal quantitative models and methodology for risk management in general. We collected from different resources and references about what best practices people are using nowadays in information system industry.