Start

ZCR 5.1 - Identify threats

List of threats

ZCR 5.2 - Identify vulnerabilities

ZCR 5.3 - Determine consequences and impact

ZCR 5.4 - Determine unmitigated likelihood

ZCR 5.5 - Determine unmitigated cyber security risk

ZCR 5.6 - Determine SL-T

ZCR 5.7 - Unmitigated risk exceeds tolerable risk?

ZCR 5.8 - Identify and evaluate existing countermeasures

ZCR 5.9 - Reevaluate likelihood and impact

ZCR 5.10 - Determine residual risk

ZCR 5.11 - Are all residual risks at or below tolerable risk?

ZCR 5.12 - Identify additional cyber security countermeasures

ZCR 5.13 - Document and communicate results