The identification, analysis, evaluation, and treatment of risk to information assets, as specified in the RM framework.