Please follow
https://www.cisa.gov/blog/2021/01/14/risk-based-approach-national-cybersecurity
.