As noted before, the Identify-Assess-Control cycle in Figure 3.2 may need to be repeated
as countermeasures can introduce new risks in their turn; risk management is an iterative
process. This process should be document and to support requirements evolution – changes
rationale for countermeasure requirement and the need for different countermeasures. The documentation is also needed for risk monitoring at system runtime and dynamic selection of more appropriate countermeasures.