A Risk Management Framework (RMF): a. is only needed for big projects b.can also be applied to non-software situations c. is designed to manage software induced business risks in a consistent and repeatable manner d. requires a large team to track and manage risks e. is about identifying, ranking, tracking, and understanding software security risk as it changes over time