I've been tasked with putting together a risk assessment for the local office where I do nuts-to-bolts IT support. So far, I've identified the key equipment, and assigned a criticality level to this equipment. I'm not sure where I should go from here. My background is much more tech-oriented - fixing and installing equipment, servers, etc. so this level of business analysis is a little new to me.

Does anyone have some good resources, or advice they could drop my way?

Summary of some risk assessment resources, with responders, suggested in response:

• http://www.securityfocus.com/infocus/1591 [John Buys]
• http://www.securitymetrics.org/content/Wiki.jsp [Lynda]
• http://www.iatrp.com/ [Brian Kirouac]
• www.rcmp-grc.gc.ca/tsb//pubs/it_sec/g2-001_e.pdf [Sean MacGuire, he of Big Brother fame