From the descriptions given on the left, indicate which ones are related to determining either $(1)$ the likelihood$/$probability of occurrence or $(2)$ the business impact, as part of a risk analysis.

Question $19$ options:

Maturity and extent of incident response processes $($such as recovery time objectives$)$

Organization's risk tolerance level

Threat actor's TTPs and capabilities

Threat source $($e$.$g$.,$ organized crime, foreign nation$-$state, opportunistic hacker, disgruntled former employee$)$

Security control measures in place

Nature of target assets and identified vulnerabilities

$1.$

Likelihood$/$probability of occurrence

$2.$

Business impact