. . "__A__ 154. ____ involves determining the damage that would result from an attack and the likelihood that the vulnerability is a risk to the organization." . .