Details.
Identify, assess, document, and prioritize information system risks and threats, evaluate confidentiality, integrity, and availability controls, and revise controls for changes in technology, emerging threats, systems, information, or business operations.