Part of the problem is a grammatical problem in the sections you quote - step 1 describes an activity, Step 4 doesn't. That makes it difficult to distinguish.
The organization identifies its business/mission objectives and high-level organizational priorities.
What are you protecting? If you protect everything, you protect nothing. Identify the critical information and services (where interruption would imperil the organization) and those which are less critical. For example, most organizations could accept a 1 week disruption of HR processes, but a serious compromise of customer data could imperil the organization within 24 hours. Losing the archive of past safety inspections would require the organization to re-enter or recreate the data, but if the critical intellectual property were disclosed, there is no recovery.
I don't think the quotes you provide really helps to understand the process.
Let's rephrase and simplify.
What am I protecting? What can I not afford to lose? To use a coarse analogy, if I lose a finger or toe, my life is still viable, but if I lose my heart or brain, I have no options. What are your organization's heart and brain? What are your toes & fingers? What about things like skin or liver that can regenerate. Another way to look at this is what do I really need?
What threatens it? What are the realistic threats. If you skip over this step, you find yourself devising strategies to prevent Godzilla attacks and Hurricanes in Switzerland/Sahara. This is a mirror image of #1 - Who are the competitors who want/need things that you want/need? Where are you involved in a zero or negative sum game? While this can include natural threats (hurricane, electrical outage, pandemic) I find that those tend to distract. Simplistically you can just identify points of conflict -but if you want to do this right, you need to understand your adversary's motivations, capabilities and opportunity.
What are you going to do about it. You've got to break this down a bit
3a) Where is my adversary most likely to take action against me? Where am I most likely to encounter the potential for harm. For most natural hazards this isn't really relevant; you can't take meaningful action to avoid a pandemic or an earthquake. Natural disasters will happen. But for adversarial actions, you can predict. If my adversary and I are competing for customers, you can figure out how your adversary is likely to leverage their advantages and your disadvantages. If you are working in IT, you can look at the technologies you use. If you're using 10+ year old technology, the adversary is more likely to attack that than new, up to date technology. Take a look at your technical debt. Take a look at your external attack surface. Take a look at your adversary and think about how you would struggle against them. Assume they're doing this to you. (this is likelihood/probability side of the risk equation)
3b) What kind of damage can my adversary inflict? Take the critical assets you identified in step 1 and assume for the purpose of argument that your adversary has already succeeded in damaging these.
- What if they disclosed your intellectual secrets (confidentiality failure)? Alternatively consider the services you provide your customers... what if your adversary could use your infrastructure to provide their customers the service. Fantastic cost savings for them, and higher cost for you?
- What if they degraded your information (integrity failure)? What if you knew your databases had a 50% error rate? If there is > 10% error, everyone will mistrust your data, including your customers and your own staff. If your adversary knows which data is in error and you don't, that is a huge competitive advantage.
- What if they denied service? (Degredation of availability) What if your adversary can take you off line or even more powerful, control when you are online and offline?
You'll need to devise strategies & mitigation plans for every intersection of asset and threat.
The critical answer to your question is that you can't do #3 unless you've identified your assets (#1) and your adversaries (#2). (I guess you can do it, but the results will be muddy, imprecise, unfocused and less useful.) If you don't know what your assets are, you need to protect everything equally; given that you probably don't have the budget to control risk on your critical assets, if you try to protect non-critical assets, you'll go broke. If you don't understand your adversaries, you're going to be in the same situation.