I have always been a proponent of doing a security risk assessment in order to determine the amount and depth of controls required to protect information appropriately.   Risk is a function of the probability and the impact of a successful…