From the descriptions given on the left, indicate which ones are related to determining either $(1)$ the likelihood$/$probability of occurrence or $(2)$ the business impact, as part of a risk analysis.

Question $19$ options:

Threat source $($e$.$g$.,$ organized crime, foreign nation$-$state, opportunistic hacker, disgruntled former employee$)$

Threat actor's TTPs and capabilities

Organization's risk tolerance level

Nature of target assets and identified vulnerabilities

Maturity and extent of incident response processes $($such as recovery time objectives$)$

Security control measures in place

$1.$

Likelihood$/$probability of occurrence

$2.$

Business impact