Risk management is an iteration of risk identification, assessment and control. Risk identification is critical and can be supported by risk checklists, component inspection, risk tree analysis and elicitation techniques. Risk assessment can be supported by qualitative or quantitative techniques for estimating risk exposure based on risk likelihood and severity of consequences. The adequacy data. Risk control consists of exploring alternative countermeasures to reduce high-exposure risks in a cost-effective way. Such countermeasures can be obtained by use of elicitation techniques, reuse of generic countermeasures to known risk classes, or operators that capture different strategies for risk reduction. The countermeasures with the highest risk-reduction leverages should then be selection. Risks should be documented to provide the rationale for countermeasures introduced in the requirements document and to support their evolution. DDP is a tool-supported approach that integrates risk Identify-Assess-Control cycles within the RE process.