Source: https://www.ustag.org/riskmanagement/members/docs/ISO31010Draft8-09.pdf