Systematic process of identifying, analyzing, and evaluating cyber risks to determine probability, impact, and treatment priority of threats. Includes qualitative and quantitative methodologies, critical asset analysis, vulnerability assessment, residual risk estimation, and definition of mitigation strategies compliant with frameworks such as ISO 27005, NIST RMF, and sector standards.