Please if you are not sure from your answer 100% do not answer the question. Thanks in advance.

Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating treatment strategies. As part of the CISO's evaluation, a judgment of potential actions, the CISO uses past experience to take into account the exposure factor as well as the external ad of the following is the CISO performing? impact based on the identified risk is performed. To prioritize response accessibility of the weakness identified. Which Documentation of lessons learned Quantitative risk assessment Qualitative assessment of risk Business impact scoring Threat modeling