Applying the concepts of risk management to the management of security threats.

It consists of identifying threats,(or risk causes),assessing the effectiveness of existing controls to face those threats, determining the risks’ consequences, prioritising the risks by rating the likelihood and impact, classifying the type of risk and selecting an appropriate risk option or risk response.