The steps are identify threats, combine these with vulnerabilities in systems and processes and then calculate the consequences if a threat is attacking a vulnerability. Combine this with an inventory of all assets, to form a list of all the cyber risks to the business, which then is prioritized based on the business impact of each risk. This forms the basis of your cyber risk management.