After the risk assessment

As part of the scoping meeting

At the kick-off meeting

During the risk assessment work

Begin risk remediation immediately as the organization is currently at risk

Decide the criteria for determining if the risk can be accepted

Design appropriate controls to reduce the risk

Remediate the risk regardless of cost

Identify, quantify and prioritize each of thebusiness-critical assets residing on the corporate infrastructure

Identify, quantify and prioritize risks against criteria for risk acceptance

Identify, quantify and prioritize the scope of this risk assessment

Identify, quantify and prioritize which controls are going to be used to mitigate risk