"Risk management is the process of determining the most beneficial combination of countermeasures and mitigation strategies that can be employed within the constraints of available resources". (Jones, ASME Critical Assets Protection Initiative, 2004, 11)