Identify assets needing protection. Not all are tangible and not all are easy to value
Hardware • Supplies
Software • Data
People • Availability
Documentation • Reputation
Determine Vulnerabilities
Any situation that could cause loss of confidentiality, integrity or availability
Several different approaches may be used
There is no single “right” approach