Editing Risk management (section)

===Method===
For the most part, these methods consist of the following elements, performed, more or less, in the following order:

# Identify the [[Cyber threat intelligence|threats]].
# Assess the vulnerability of critical assets to specific threats.
# Determine the [[risk]] (i.e. the expected likelihood and consequences of specific attacks on specific assets).
# Identify ways to reduce those risks.
# Prioritize risk reduction measures.
'''The Risk management''' knowledge area, as defined by the [[Project Management Body of Knowledge]] PMBoK, consists of the following processes:

# '''Plan Risk Management''' – defining how to conduct risk management activities.
# '''Identify Risks''' – identifying individual project risks as well as sources.
# '''Perform Qualitative Risk Analysis''' – prioritizing individual project risks by assessing probability and impact.
# '''Perform Quantitative Risk Analysis''' – numerical analysis of the effects.
# '''Plan Risk Responses''' – developing options, selecting strategies and actions.
# '''Implement Risk Responses''' – implementing agreed-upon risk response plans. In the 4th Ed. of PMBoK, this process was included as an activity in the Monitor and Control process, but was later separated as a distinct process in PMBoK 6th Ed.<ref name="Morcov2021">Morcov, Stefan (2021). Managing Positive and Negative Complexity: Design and Validation of an IT Project Complexity Management Framework. KU Leuven University. Available at https://lirias.kuleuven.be/retrieve/637007</ref>
# '''Monitor Risks''' – monitoring the implementation. This process was known as Monitor and Control in the previous PMBoK 4th Ed., when it also included the "''Implement Risk Responses''" process.