In your experience, are sections on risk and risk management typically part of technical standards documentation?
For example, in a document that describes how the Network Time Protocol is implemented and deployed throughout a network, does it make sense to talk about organizational risk?
Do people usually create a single "risk" document, with sections for each technology? (As opposed to splitting the Risk and Risk Management sections throughout a myriad of documents.)
The documentation must be in Microsoft Word, so a wiki solution is not possible (at this time).
Thank you for your opinions!