According to NIST SP $800-37,$ the Risk Management Framework for Information Systems and Organizations, which stage of a risk assessment includes risk analysis and determination?

$1.$

Stage $3$: Select Security Controls includes risk analysis and determination.

$2.$

Stage $4$: Implement Security Controls includes risk analysis and determination.

$3.$

Stage $5$: Assess Security Controls includes risk analysis and determination.

$4.$

Stage $6$: Authorize Information System includes risk analysis and determination.