From the National Institute of Standards, we can see many handy guidelines and processes for risk management. They really look like the traditional system engineering process. The methodology they use involves two main sections. One is for development, the other one for maintenance. The development one slices things using SDLC phases, while the operation ones focus on security risks. We would like to say functional and performance risks are also as important.