Risk assessment and analysis
2. Determine the critical level of assets
3. Identify the threats to each critical asset
4. Identify the existing countermeasures (existing security is existing countermeasures)
5. Determine the vulnerability level of each critical asset
6. Determine the risk level of each critical asset
7. Recommend security upgrades to reduce high levels of risk
8. Perform a cost-benefit analysis in support of upgrade recommendation if possible