No, it’s not a formal Risk Assessment which evaluates risk against an organisations risk appetite (although a formal RA can be offered if that’s preferable). This assessment is focused more on identifying residual risk in an eCom business.