Conducting a Security-Risk Assessment: Based on the nature of business, the most critical threats need to be first understood. These include natural disasters, malicious human attacks or system failures, to