At FPA level : - Define Risk Appetite ("impact") -- Financial -- N persons impacted --- non sensitive data --- sensitive data --- personal integrity -- N enterprises impacted -- Juridical -- Image of FPA -- Disruption of public order -- Potential of higher level (regional, national, international) impact - Make inventory of assets - Categorise assets (criticality) - Assessment of FPA risks / vulnerabilities - Implementation of FPA Control Measures Publication of Risk / Security Policy - Per category of assets