[SP 800-30] Evaluation and assessment [Risk IT] RG2 Integrate with ERM. RE2.4 Perform a peer review of IT risk analysis. RG2.5 Provide independent assurance over IT risk management [ISO/IEC 27005:2008] 
Risk monitoring and review
C o n t e x t e s t a b l i s h m e n t
R i s k a s s e s s m e n t
R i s k t r e a t m e n t
R i s k a c c e p t a n c e
R i s k c o m m u n i c a t i o n
R i s k m o n i t o r i n g a n d r e v i e w