To identify and classify risk, it is necessary to examine all activities and relationships of...

Risk assessment in the PSP framework is centered on understanding the interplay between assets, exposure, and losses.

Assets are the people, property, information, and operations that must be protected.

Exposure represents the vulnerability or likelihood that an asset will be affected by threats or hazards.

Losses are the potential consequences, whether financial, operational, reputational, or physical, if a threat materializes.

By systematically analyzing these three considerations, security professionals can prioritize risks, allocate resources effectively, and design appropriate mitigation strategies. Countermeasures are developed later as responses to identified exposures and potential losses, not as a primary input to risk classification. This aligns with ASIS guidance on structured risk assessment and enterprise security risk management.