(f) Risk assessment. All participants should conduct periodic risk assessments that identify threats and vulnerabilities; are sufficiently broad-based to encompass key internal and external factors, such as technology, physical and human factors, policies and third-party services with security implications; allow determination of the acceptable level of risk; and assist in the selection of appropriate controls to manage the risk of potential harm to information systems and networks in the light of the nature and importance of the information to be protected;
(f) 风险评估。所有参与者应定期进行风险评估，这些评估应：指出各种威胁和弱点；基础广泛，足以包含关键的内外因素，例如技术、物质和人的因素、政策及涉及安全问题的第三方服务；能够确定可接受的风险水平；协助选择适当的控制手段，根据所要保护的信息的性质和重要性，管理可能对信息系统和网络造成危害的风险；