Besides the two SQL 2003 database servers (Core i5 + 16GB), most other servers are commodity x86 servers, and no maintenance contracts exist for either the hardware or any installed software. Which belongs to servers and desktops that are more than five years old. Employees can also work from home after work and use their home computers, tablets, or mobile devices to access various services.

The servers are not really running the most recent operating systems, and they've never been patched in a long time. Even though all servers have publicly available IP addresses, they may be reached over the Internet. The company does not have a firewall or any other security system in place. Currently all services offered by the servers are accessible via the Internet.

Q1. Which risk management Framework shall be used and why?

Q2. How would you do qualitative risk analysis for this question?

Q3. What are the Assets Identification ,risk control ,risk management and risk evaluation for this question?