...
- Mapping of information assets and value assessment
- Mapping of existing mitigating activities
- Mapping of risk elements
- Assessment of risk level (consistency and probability)
- Measures in relation to risk factors
- Categorization and prioritization of measures
- Approval of measures
- Risk treatment. Implementation and follow-up of measures