Basis for Risk Management in general are the following steps:
• Know the hazards and threats that may cause problems for both activities and organization
• Identify events that may jeopardize the normal operation
• Inventorize the available controls that could prevent or limit undesirable events and ensure proper functioning of these controls (prevention).
• Identify consequences of the most threatening events.
• Inventorize protection and mitigation measures/defenses that might limit the consequences (repression).
• Take appropriate actions (including incident analysis) to ensure that all controls and defenses are functioning as intended.