Turns assets, threats, likelihood, impact, and control effectiveness into risk registers, treatment decisions, and clear statements of residual risk.
