It assigns numeric values to exposures of assets.

It requires more resources than other methods

It produces the results in numeric form.

It is based on impact analysis of information assets

Monitoring risk responses

Applying risk treatments

Providing assurance of control effectiveness

Implementing internal controls

develop a comprehensive risk mitigation strategy

develop understandable and realistic risk scenarios

identify root causes for relevant events

perform an aggregated cost-benefit analysis

Communicate potential impact to decision makers.

Research the root cause of similar incidents.

Verify the response plan is adequate.

Increase human resources to respond in the interim.

To determine the likelihood and impact of threats to business operations

To identify important business processes in the organization

To estimate resource requirements for related business processes

To evaluate the priority of business operations in case of disruption