Going through the process of identifying, analyzing, and evaluating risk. It helps to guarantee that the cybersecurity controls you are choosing are suitable for the risks your organization may face.