A computer-implemented method comprising: selecting an entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) communicatively coupled to a network (100, 200); determining a cyber-attack likelihood value and a cyber-attack impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining a cyber-attack risk based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining an operational failure likelihood value and an operational failure impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining an operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining a risk value for the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) based on the cyber-attack risk and the operational failure risk; determining a risk value for a location of the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) based on a plurality of risk values associated with a plurality of entities associated with the location; and storing the risk value for the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) and the risk value for the location, in order to prioritize a response. selecting an entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) communicatively coupled to a network (100, 200); determining a cyber-attack likelihood value and a cyber-attack impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining a cyber-attack risk based on the cyber-attack likelihood value and a cyber-attack impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining an operational failure likelihood value and an operational failure impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining an operational failure risk based on the operational failure likelihood value and the operational failure impact value associated with the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280); determining a risk value for the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) based on the cyber-attack risk and the operational failure risk; determining a risk value for a location of the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) based on a plurality of risk values associated with a plurality of entities associated with the location; and storing the risk value for the entity (104, 106, 120, 122, 130, 150, 202, 206, 210, 220, 230, 232, 234, 260, 262, 280) and the risk value for the location, in order to prioritize a response.