Decide what matters
Identify material organizational activities and the outcomes they sustain.
Translate strategic attributes into management-owned, measurable risk limits.
Trace people, process, technology, data, and physical dependencies.
Map threat communities, paths, actions, and loss-event boundaries.
Estimate FAIR frequency and FAIR-MAM magnitude as defensible distributions.
