Security incident response: rethinking risk management. - Christopher J. Alberts; Audrey J. Dorofee (CARS, 2004)

Beyond good practice: why HIPAA only addresses part of the data security problem. - Jeffery Collmann; D. Lambert; M. Brummett; D. DeFord; Johnathan Coleman; Ted Cooper; Keith R. McCall; Dennis M. Seymour; Christopher J. Alberts; Audrey J. Dorofee (CARS, 2004)

Considering Operational Security Risk during System Development. - Carol Woody; Christopher J. Alberts (IEEE Secur. Priv., 2007)

A Systemic Approach for Assessing Software Supply-Chain Risk. - Christopher J. Alberts; Audrey J. Dorofee; Rita Creel; Robert J. Ellison; Carol Woody (HICSS, 2011)