A bottom-up approach to risk scenario development starts at the operational level. It involves those closest to the I&T functions---the people actually performing the work---developing scenarios based on their understanding of potential risks and vulnerabilities within their specific areas. These scenarios are then aggregated and analyzed at higher levels.

While anyone in the organization can contribute to risk identification (A), a bottom-up approach specifically relies on the expertise of those performing specific I&T functions (B). It should be used in conjunction with other approaches (C), such as top-down, for a comprehensive view.