The department has launched risk analysis initiatives at national labs, rather than waiting for the perfect metrics, to establish standards.

Until individual agencies like the Department of Energy and Department of the Treasury see success quantifying risk, the practice won't likely be mandated.