Ensure practical, cost-effective
Understand the Risk
Determine the likelihood and damage of a threat
A threat needs to be well understood to determine the likelihood and impact of its realization.
Ranking the most critical to the least
Derive the most-to-least critical order of the risks. This will provide the basis for allocating resources to mitigate and prevent.