From the descriptions given on the left, indicate which ones are related to determining either (1) the likelihood/probability of occurrence or (2) the business impact, as part of a risk analysis. Question 19 options: Threat source (e.g., organized crime, foreign nation-state, opportunistic hacker, disgruntled former employee) Threat actor's TTPs and capabilities Maturity and extent of incident response processes (such as recovery time objectives) Nature of target assets and identified vulnerabilities Organization's risk tolerance level Security control measures in place 1. Likelihood/probability of occurrence 2. Business impact