Source: https://www.cisa.gov/sites/default/files/publications/Risk Assessment Methodologies.pdf