Identify and evaluate IT risk

Trigger: A scheduled IT risk assessment cycle begins or a significant change is proposed to the IT infrastructure.

1. Scan IT environment and project portfolios for emerging threats
2. Catalog identified vulnerabilities in a centralized risk register
3. Evaluate the probability of occurrence for each identified risk
4. Assess the potential business and operational impact of realized risks
5. Prioritize risks based on combined severity scores

Outcome: Identified IT risks are cataloged, scored for potential impact and likelihood, and prioritized for mitigation.