Deming's principles applied to IT security programs

The IPlocks blog has a very interesting article using the 14 points of Deming (Quality management) and applying them to risk management:

What struck me after a few months, having studied Kaizen, Deming and participated in a number of different Total Quality Management programs earlier in my career, that there were tremendous similarities in the motivation and processes common to both Risk Management and these quality driven programs. Both security and quality are difficult to quantify and measure internally, but metrics need to be applied. Both are often treated as a ‘thing’ or a destination, when they are in fact a cyclic process. Both are as much about people and process as they are technology, but seldom treated that way. Both need to be systemic to an organization to be effective. Both need to be implemented across the entire process lifecycle. Both are focused on efficiency in their approach to solving problems.

Read more.