When assembling IT risk scenarios, it is MOST important that the scenarios: • consider the information criteria of efficiency, effectiveness, and availability. • are linked to relevant business risk and corresponding information classification. O describe worst-case situations and the inherent likelihood of risk. • can be used for efficient risk identification and subsequent risk analysis