Use the basic approach to Risk Management of Identification, Assessment, Management and Monitoring to define the infrastructure both under the direct control of the company and out the control of the company. For instance, inside would be the machinery, people, IT systems, communications systems... etc. Outside would be the security, water, power, supply chain... etc. Then list the threats and hazards to the company (internal and external). The choose 1 asset or capability you identified and propose how you would manage risk to it from a resiliency and mitigation standpoint