Division 4.2.1 Organisers shall use risk management processes to identify the risks linked to the use of their systems, including for the rights and freedoms of signatories, and to determine the appropriate and proportional measures to prevent and mitigate the impact of incidents affecting the security of the network and information systems that they use in their operations.

The risk management process shall focus particularly on the risks related to the confidentiality and integrity of the information in the system. These risks can be the result of threats, including:

1. (a)

   user errors;

2. (b)

   system/security administrator errors;

3. (c)

   configuration errors;

4. (d)

   malware infection;

5. (e)

   accidental alteration of information;

6. (f)

   information disclosure or leaks;

7. (g)

   software vulnerabilities;

8. (h)

   unauthorised access;

9. (i)

   interception or eavesdropping of traffic;

10. (j)

    data protection risks.