Jerome's organization preparing to perform a thorough security risk assessment for their computers and networks. When Jerome reviews the assessment plan, he notes that the third step, after identifying the high$-$priority IT assets and the loss events or threats that could occur, is

a$.$ assessing the feasibility of implementing various mitigation options

b$.$ performing a costs$-$benefit analysis to ensure security efforts will be cost effective

c$.$ assessing the frequency of events or the likelihood of each potential threat

d$.$ determining how loss events or threats can be mitigated