What risk capabilities do we need?

• Participation by key stakeholders in the organization for risk and response and recovery

• Commitment to assess, prioritize, and implement measures to mitigate risk

• Situational awareness

• Analytical and forensic capabilities

• Incident response capability