Risk Assessment

Before you can assess any risks, it helps to identify what they are. The obivious ones are viruses, adware, malware, etc. Others are access issues, hardware accountabilty, asset tracking.

Once you know potential risks, you can measure how vulnerable you are.

...there is a risk assessment section and appendix here, as part of a proposal, that may give you some food for thought about how it's done in other arenas. This speaks to form, rather than content.

http://www.blm.gov/sco/sco_bus_casev3_template.doc

As for content...my $.02 is to never underestimate entrenched resistance to change as a risk. Some of your biggest risks may not be technological in nature. They may be political or otherwise deal with "people issues." You probably will not formally be able to document some of these in a document for distribution. Still, I go through the risk analysis process on these issues, for my own information.