Risk Determination – determine risks about the system as a whole, about the processes and about the products or services delivered.
Prioritize Risks - Risks do not all have the same importance. Some will be more serious than others. It is necessary to arrange criteria for classifying and distinguishing the most serious risks from the least serious ones.
Mitigate Risks – Develop actions that minimize the consequences of the risks and or the likelihood of their occurrence.
Measure Effectiveness – Evaluate if the actions were effective in handling the priority risks.