Three key elements need to be considered in determining risk: $(1)$ the assets that an organization has; $(2)$ the degree of exposure the company has; and $q,$

The costs related to the threat

The dangers associated with the threat

The types of losses a company could experience

$$

The expertise needed to address the risk