The first step in risk management is to establish the scope and actions required. Risk management is the process that involves identifying, analyzing, evaluating, and treating the risks that may affect the security or objectives of an organization. The first step in risk management is to establish the scope and actions required, which means defining the boundaries, objectives, and criteria of the risk management process, and determining the roles, responsibilities, and activities of the risk management process. Establishing the scope and actions required can help to provide a clear and consistent direction and guidance for the risk management process, and to ensure the alignment and integration of the risk management process with the organizational strategy, culture, and values . References: [CISSP CBK, Fifth Edition, Chapter 2, page 121]; [CISSP Practice Exam - FREE 20 Questions and Answers, Question 11].