Assessing the exposure and vulnerability of assets

Estimating the risk based on likelihood and severity

Designing strategies and tactics to mitigate the risk

Inventoring assets and identifying the threats against those assets