The agency's risk assessment process should not disclose the risks considered.
In addition, the agency's risk assessment process (as called for in the OMB guidance14) should disclose the risks considered that would prevent the system from successfully complying with the criteria selected by the agency.