On the other hand, I don't see a lot of regulations and guidelines in the enterprise architecture area that have human factors involved. This is always important. People who are working in this area are aware of them, but they are not extensively written on paper in risk evaluation models. In the first section, the models we have could cover some of the social, human aspect of risk management that is also possible to get integrated into existing methodology. Enterprise architecture risk is not only focused on security, although this is a very important factor.