2. Conduct Risk Assessment and Business Impact Analysis