Systematic process of identifying, analyzing, and prioritizing cyber risks according to ISO 27005, NIST RMF, FAIR, or proprietary frameworks. Includes risk assessment for NIS2, DORA, and sector-specific compliance, threat modeling, technical and organizational vulnerability analysis, likelihood and impact evaluation, definition of risk appetite and tolerance, risk treatment (mitigation, acceptance, transfer, avoidance), and management of supply chain and third-party risks.