Requirement 12.1.2

Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.