Identify 2.2.4 Risk assessment The organisation understands the effects of cybersecurity risks on business operations, assets and individuals, including reputational risks. Description Task ID.RA-1 Identify the (technical) vulnerabilities of your assets, and document them. ID.RA-2 Share intelligence regularly in fora and other bodies to stay up to date about cybersecurity threats. ID.RA-3 Identify and document internal and external cybersecurity threats. ID.RA-4 Identify the possible business impacts of cybersecurity threats, and calculate the probability of their occurring. ID.RA-5 Rate the risks to your organisation based on threats, vulnerabilities, impacts (on business activity) and probabilities. ID.RA-6 Define possible immediate responses should a risk occur, and prioritise these measures. Table 9: ID.RA tasks Standard Reference COBIT 5 APO12.01, APO12.02, APO12.03, APO12.04, APO 12.05, APO 13.02, DSS04.02 ISA 62443-3:2013 4.2.3, 4.2.3.9, 4.2.3.12 ISO 27001:2013 A.12.6.1, A.18.2.3, A.6.1.4 NIST-SP-800-53 Rev. 4 CA-2, CA-7, CA-8, RA-3, RA-5, SA-5, SA-11, SI-2, SI-4, SI-5, PM-15, PM-16, SI-5, RA-3, SI-5, PM-12, RA-2, PM-9, PM-11, SA-14 BSI 100-2 M 2.35, M 2.199, M 2.546 Table 10: ID.RA references Minimum ICT standard 2018 18