▁advers ely ▁affect ▁those ▁activities , ▁and ▁assign ▁values ▁to ▁the ▁business ▁impact s . ▁▁ ▁The ▁business ▁processes ▁are ▁analyz ed ▁further ▁in ▁order ▁to ▁identify ▁and ▁map ▁out ▁the ▁associated ▁organiz ational , ▁human ▁and ▁technical ▁assets . ▁ ▁The ▁assets ▁are ▁class ified ▁according ▁to ▁three ▁classic ▁security ▁criteria ▁( conf ident ial ity , ▁integrity , ▁avail ability ) ▁plus ▁the ▁need ▁for ▁comp liance ▁to ▁applicable ▁laws ▁and ▁reg ulations ▁( e . g . ▁to ▁protect ▁personal ▁information ▁or ▁the ▁environment ). ▁ ▁The ▁intr insic ▁lik elihood / prob ability ▁of ▁representative ▁threat ▁event ▁types ▁is ▁considered . ▁ ▁These ▁elements ▁are ▁combined ▁automatically ▁to ▁analyze ▁and ▁assess ▁the ▁intr insic ▁sever ity ▁of ▁ris ks ▁( based ▁on ▁ 8 0 0 ▁' sc en arios ' ▁in ▁the ▁knowledge base ), ▁highlight ing ▁the ▁most ▁critical ▁and ▁serious ▁ones ▁according ▁to ▁the ▁project ed ▁business ▁consequences . ▁ ▁Di agnostic ▁question na ires ▁help ▁users ▁evaluate ▁the ▁ability ▁of ▁their ▁existing ▁information ▁security ▁measures / controls ▁to ▁mit ig ate ▁ris ks . ▁ ▁Security ▁measures ▁( organ iz ational ▁and ▁technical ) ▁are ▁grouped ▁into ▁services ▁for ▁discussion ▁with ▁the ▁relevant ▁man agers ▁and ▁profession als . ▁ ▁The ▁current ▁sever ity ▁level ▁of ▁each ▁risk ▁scenario ▁is ▁displayed , ▁taking ▁account ▁of ▁the ▁effect iveness ▁of ▁existing ▁security ▁measures , ▁giving ▁an ▁indic ation ▁of ▁the ▁current ▁information ▁security ▁risk ▁landscape ▁and ▁suggesting ▁the ▁prior it ization ▁of ▁rem ed ial ▁work