 The sum of the products of the threats' impact and the probability of their occurring is the total risk to the information asset.With the risk assessment complete, the IA practitioner then develops a risk management plan.This plan proposes countermeasures that involve mitigating, eliminating, accepting, or transferring the risks, and considers prevention, detection, and response to threats.