(2) identifies reasonably foreseeable internal and external risks;
(3) assesses the sufficiency of safeguards in place to control the identified risks;
(1) assesses risks in network and software design;
(2) assesses risks in information processing, transmission and storage;
(1) assesses risks of information storage and disposal;