1. A method for technology risk assessment, comprising: identifying software characteristics associated with a plurality of software processes; identifying software characteristic values associated with each software characteristic, said values reflecting a degree of security risk associated with the software process; identifying at least one technology control to be applied to a selected software process; apply a modifier to a software characteristic value associated with the selected software process, the modifier being a function of the extent to which the technology control reduces a security risk associated with the software characteristic; calculating a risk index as a function of the modified software characteristic value; and presenting an enterprise risk assessment that includes the risk index.