text: Chapter 4
  Note. Access to an enemy’s cyberspace capability does not guarantee the success of an employed
  cyberspace attack. The combat mission team must tailor the capability to create the desired effect
  on an enemy’s cyberspace capability.
  RISK MANAGEMENT
  4-85. Risk management is the process to identify, assess, and control risks and make decisions that balance
  risk cost with mission benefits (JP 3-0) and an element of command and control. Risk is the exposure of
  someone or something valued to danger, harm, or loss, and is inherent in all operations. The commander and
  staff conduct risk management throughout the operations process to identify and mitigate risks associated with
  hazards that can cause friendly and civilian casualties, damage or destruction of equipment, or otherwise impact
  mission effectiveness. Aspects of cyberspace defense and security operations and EP missions include risk
  mitigation measures as part of risk management.
  4-86. Risk management is integrated into planning activities and continues throughout the operations
  process. Risk management consists of the following steps:
  * Identify the hazards.
  * Assess the hazards.
  * Develop controls and make risk decisions.
  * Implement controls.
  * Supervise and evaluate.
  4-87. The CEMA section, as with all staff elements, incorporate risk management into cyberspace operations
  and EW-related running estimates and recommendations to mitigate risk. The G-3/S-3 coordinates risk
  management amongst all staff elements during the operations process. For more information on the risk
  management process, see ATP 5-19.
  RISKS IN CYBERSPACE AND THE ELECTROMAGNETIC SPECTRUM
  4-88. Risk is inherent in all military operations. When commanders accept risks, they create opportunities to
  seize, retain, and exploit the initiative and achieve decisive results. The willingness to incur risks is often the
  key to exposing an enemy’s weaknesses that the enemy considers beyond friendly reach. Commanders assess
  and mitigate risks continuously throughout the operations process. Many risks to the DODIN-A come from
  enemies, adversaries, and insiders. Some threats are well equipped and well trained, while some are novices
  using readily available and relatively inexpensive equipment and software. Army users of the DODIN are
  trained on basic cyberspace security, focusing on the safe use of information technology and understanding
  common threats in cyberspace.
  4-89. Risk management is the Army’s primary decision-making process for identifying hazards and
  controlling risks. The process applies to all types of operations, tasks, and activities, including cyberspace
  operations. The factors of mission, enemy, terrain and weather, troops and support available, time available,
  and civil considerations provide a standardized methodology for addressing both threat and hazard-based risks.
  Risks associated with cyberspace operations fall into four major categories—
  * Operational risks.
  * Technical risks.
  * Policy risks.
  * Operations security risks.
  Operational Risks
  4-90. Operational risks pertain to the consequences that cyberspace and EMS threats pose to mission
  effectiveness. Operational consequences are the measure of cyberspace attack and EA effectiveness.
  Cyberspace intrusions or attacks, and likewise in the EMS, can compromise networks, systems, and data, which
  can result in operational consequences such as injury or death of personnel, damage to or loss of equipment or
  property, degradation of capabilities, mission degradation, or even mission failure. Exfiltration of data from