This report is part two of a four-part series analyzing the RPAA and identifying key components of the law that PSPs should consider when doing business in Canada. This report focuses on the requirement to establish and implement a risk management and incident response framework.