A dynamic and iterative process for identifying risks to achieving agency objectives, analyzing the risks, and using that information to decide how to respond to risks.