Once risks are identified, you can rank them based on operational goals, business risk tolerance, regulatory considerations, and other criteria dependent on what’s most important to the business. The processes that handle sensitive data must also be known and documented.
One you’re familiar with sensitive data and its possible threats, you can develop a risk prioritization scorecard. The scorecard catalogues each risk in a spreadsheet, and measures its impact against whether confidentiality, integrity, or availability could be compromised.
The individual risks are then plotted on an X-Y graph with likelihood to occur on the X axis and impact of occurrence on the Y axis. The risk prioritization chart, derived from the risk scorecard, visually shows in the upper right quadrant the most likely and impactful risks facing the business—and those that should be addressed first.
While this process is somewhat subjective and qualitative, take care to build it carefully because it will serve to inform executive leadership of the business risk profile.