process of analyzing threats to and vulnerability of a facility, determining the potential for losses and identifying cost-effective corrective measures and residual risk (Garcia 300).