The situation is that I am a software developer working for this company since last January and was asked to do information security for my business unit on the side. I don't have a lot of experience with info-Sec (however, I've always had an interest in it and held a security+ cert) and now I have to do a risk analysis based on the analysis of last year (when I didn't work here yet). The company is quite new to the concept of security, so the previous analysis consists of some threats, frequencies and impacts. What they didn't do last year is naming any controls to mitigate the risks.
I want to determine some controls to add this year, however the more I read/view into the subject matter the more I see I'm missing vital information for doing so.
For example: the course Managing Information Security Threats & Risks (ISO/IEC 27002) mentions the need to know what information there is, who its owners are and what the value of that information is so you can begin estimating the potential loss when a threat occurs. On top of this you need to know what the Exposure Factor is to be able to calculate SLE. Without it I feel that I can't even begin to name controls to apply to threats/risks.
How can someone in my position best get all this information?