The EU legislation deliberately demands a risk-based approach. The bottom line here is that we should focus our cybersecurity ...