MS identifies the scope, identifies measures to reduce risks, collects data, Analyzes the policies and procedures, as well as we do Vulnerability Analysis, Threat Analysis, Analysis of the acceptable risks and we prepare a Risk Analysis Report.