After categorizing the assets to be protected, a security program must then identify the risks to these assets, so that they are secured and protected from harm. Research to learn the processes used to identify potential risks to an organization's assets (physical, logical, or both).

1. What are 3 or more major steps in an organizational risk assessment program?
2. What is the objective of each of the steps you've identified?
3. Should an IT risk assessment program be a requirement for all organizations?