Step 2 — Evaluating and prioritizing risks