Organisaatio on määritellyt menettelyt tietoturvariskien arvioimiseksi ja käsittelemiseksi. Menettelyihin sisältyy ainakin:

• Riskien tunnistamismenetelmät
• Riskianalyysimenetelmät
• Riskien arviointiperusteet (vaikutus ja todennäköisyys).
• Riskien priorisointi, käsittelyvaihtoehdot ja valvontatehtävien määrittely.
• riskien hyväksymiskriteerit
• Prosessin toteuttamissykli, resursointi ja vastuut
• Tulokset olisi sisällytettävä organisaation riskinhallintaprosessiin.

Tehtävän omistaja tarkistaa säännöllisesti, että menettely on selkeä ja tuottaa johdonmukaisia tuloksia.

The organization, engaged in security-sensitive activities, is required to assess their need for protective security through a documented analysis. Security sensitive activities include handling classified information, or conducting any other security sensitive activities of importance to Sweden's security. The security protection analysis should answer the following questions:

• What should be protected? Does the business handle classified information? Are there facilities, objects, systems, property and other assets of importance to Sweden's security?
• Against what should it be protected? What security threats exist against the activities covered by the Security Protection Act? What vulnerabilities exist in the business?
• How should it be protected? Based on identified vulnerabilities, what security protection measures are necessary to take? Security protection measures can be divided into personnel security, physical security and information security.

The completed analysis must be documented, resulting in a plan that justifies each security measure and defines responsibilities and timelines. The security measures detailed in the analysis must be implemented and can include physical access controls, secure information handling practices, or staff-related procedures, depending on the risks identified.

It must also be stated when the measures are to be taken and which function is responsible for them.

The organization shall establish and maintain a documented process for reporting, managing, learning from security-related incidents and continuously monitoring its protective security status.

The process must ensure ongoing oversight of security measures to confirm they remain effective against evolving threats and operational changes. It must also provide clear, accessible instructions for all personnel on incident handling. At a minimum, the documented process shall define:

• The key activities and indicators that are regularly monitored (e.g., compliance with policies, access logs, system changes).
• What to report: The types of events that must be reported (e.g., security breaches, suspicious activity).
• The procedure for reporting, including escalation to internal roles and external authorities
• How reported incidents are logged, investigated, and used to improve security measures.