As a starting point, the paper provides some references and resource to initiate more quantitative ways of assessing risks management in enterprise architecture. Deriving the quantitative models for enterprise is too much of an effort for the paper and is out of scope. We hope we can provide bits and pieces for people who are interested.