The design phase undertakes multiple operations, namely designing risk assessment processes, identifying objectives, risks, and control, choosing score metrics, defining project categories, defining roles and access levels, and developing self-assessment questions.