Learn in the textbookThe Risk Assessment Process
DefinitionRisk identification (リスク特定) is the first step of risk assessment: finding and writing down the risks faced by the information assets to be protected.
ExplanationYou list the target information assets, combine the threats and vulnerabilities related to each, and describe what could happen. In an ISMS (the system by which an organization continuously manages information security), the targets are the information inside the scope (適用範囲) the organization has defined. A risk missed here is not handled in any later step either, so the net has to be cast wide.
AnalogyIt is like the stage before a trip when you jot down everything that could go wrong, such as losing your wallet, the trains stopping or the hotel booking falling through.
Memory hookIdentification is the word behind ID, as in an ID card. Link it to the stage where you first establish who or what is out there.