The first steps in risk management are risk discovery and risk quantification.
What systems and services can a change impact? What are the worst-case
scenarios? How many of your customers could these scenarios affect? It helps
to categorize machines by usage profile, such as infrastructure machines, departmental
servers, business-critical, or desktops and to quantify the number
of machines that the change impacts.