content_image/461941.jpg content_image/461942.jpg content_image/461943.jpg
<img src='content_image/461941.jpg'>

<img src='content_image/461942.jpg'>

The central idea of ECHA’s iterative life -cycle model is that IT Security is continuously improved and developed in this continuous cycle. 

## 3.13.2. IT Security Risk Assessment 

The purpose of the security risk assessment is to identify, evaluate and categorize any relevant security risks, including liability risks, operational disruptions, reputational harm and financial loss. Effective risk management requires assessment of inherently uncertain events and circumstances, typically addressing two dimensions: how likely the uncertainty is to occur (probability), and what the effect would be if it happen (impact). 

The IT Security risk assessment methodology applied at ECHA contains following phases: 

<img src='content_image/461943.jpg'>

The risk assessment workflow and its phases 

