1. Understand the service
Identify the people, technology and third parties that support each priority service.
2. Evaluate plausible disruption
Use evidence to understand exposure, existing controls and the impact of a failure.
3. Decide and follow through
Record treatment choices, ownership, acceptance decisions and review dates.
A risk assessment is a working management tool. Adapt methods and criteria to your organisation.