Watch this video on YouTube
Which of the following should be the PRIMARY basis for the development of an IT risk scenario?