01
Qualify the context
Identify critical assets, feared events, dependencies, exposure and operating constraints.
Vulnerabilities & risk
Vulnerabilities, MCO/MCS & risk analysis
Prioritize CVEs, hardening gaps and risk scenarios by exposure, business impact and operating constraints.
02
Build risk scenarios
Describe threat sources, attack paths, likelihood, impacts and existing measures.
03
Prioritize remediation
Produce a backlog that connects CVEs, exposure, affected assets, actions, correction evidence and residual risk.
Deliverables
What remains usable after the mission
risk scenarios
CVE/remediation backlog
KPI/KRI
residual-risk decisions