CC3.2 CC3
Risk Assessment / CC3.2
Identifying and analyzing risk to those objectives
In plain English
Risks are identified across the organization, analyzed for likelihood and impact, and used to decide how they will be managed. This is where the threats become a ranked list rather than a vague unease.