How are the Risk calculated on CI's ? Any best practices or documentations for this ?

[manita1]

I know Best practice is to have it at Business Application level, but if customer does has Business App for each CI, how would they risk those CI's  ?