Understand the internal factors that could impact or influence the RM process:
The organization’s governance structure (or lack thereof).
The organization’s internal stakeholders.
The organization’s culture.
The maturity of the organization’s information security program.
The organization’s experience in policy, planning, and risk management in general.