In terms of ICS/SCADA risk management and auditing, demonstrate how to use your knowledge of the risk

Question:

In terms of ICS/SCADA risk management and auditing, demonstrate how to use your knowledge of the risk as function of M, AV, T, and V. That is R = f (M, AV, T, V). Where:
R - Risk,
M - Mission importance,
AV - asset values,
T - Threats,
V - Vulnerabilities
Answer the following "Integrity Monitoring" and "Data Management and Records Retention" questions. What do you feel are the most important elements of successfully monitoring? Can you provide some examples of successful logging and data retention schedule?