Identify the vulnerabilities and threats
Identify the possible risks in terms of confidentiality, integrity, availability and authenticity of data.
A vulnerability is a weak spot in your network that might be exploited by a security threat. Risks are the potential consequences and impact of unaddressed vulnerabilities. Some of the risks associated with that vulnerability include loss of data, failure to conduct your business and reputational or financial damage to the company.
The method for identifiying vulnerabilities and threats can differ, depending on the methodology used.