Risk management is the most important part of any enterprise, therefore IT policies must be considered to identify and prioritize risks. To avoid risk, users must include in the policy what to do for risks and what to do if there is something really dangerous.