Risk assessment (CISM – Domain 2nd)