Joe, the information security manager, is tasked with calculating risk and selecting controls to
protect a new system. He has identified people, environmental conditions, and events that could
affect the new system. Which of the following does he need to estimate NEXT in order to complete
his risk calculations?

A.
Vulnerabilities

B.
Risk

C.
Likelihood

D.
Threats