NIST, Risk Management Guide for Information Technology Systems (NIST Special Publication 800-30) (July 2002) (full-text).