RA-3: Risk Assessment

a document in which risk assessment results are to be documented (if not documented in the security and privacy plans or risk assessment report) is defined (if selected);

the frequency to review risk assessment results is defined;

personnel or roles to whom risk assessment results are to be disseminated is/are defined;

the frequency to update the risk assessment is defined;