The ICT Risk Management process was defined within the TIM Group through an organizational procedure with reference to the main frameworks and international best practices, including NIST (to identify security requirements) and CSA (to direct security issues in cloud environments).