An information security officer creates a document that identifies downtime, the likelihood of occurrence, the probable impact of the downtime, and steps to mitigate the downtime and scores the likelihood based on defined security controls.

What is the information security officer creating in this instance?