The risk assessment clarifies the risks that your processing of personal data exposes. Based on the identified risks, you should assess what level of risk you are willing to accept.  Generally speaking, your appropriate security measures should increase when processing increasingly sensitive personal information, several kinds of personal information, and when the volume of data subjects increases.  Unfortunately, there is no one-size-fits-all when setting an appropriate level of security for the risk, and there are no shortcuts. Fortunately, this is also an advantage as it allows you to implement the security measures most suitable to your needs.