Under Gramm-Leach-Bliley issued Security Guidelines, which is not a required step of a risk assessment:

Identifying reasonably foreseeable internal and external threats

Assessing the likelihood of identified threats

Assessing sufficiency of the policies and procedures to control identified risks

Analyzing every solution from a cost-benefit approach

Applying each of the steps to disposal of customer information