IT RISK Assessment

IT RISK Assessment

I am trying to refresh my memory - I have been out of field for 1 yr due to family issues. Does this sound right?
Manager would give me the application I would be responsible for. I would also get info about App, such as stakeholders, data classification, # of users, etc.

Would research App using SOC 2 reports,
Open source research, & other documentations to populate the questionnaire.
(Questionnaire would have several categories, such as business …

app application assessment classification cybersecurity data data classification etc family info it risk manager memory research responsible risk risk assessment sound stakeholders