Which of the following does not represent a fundamental concept associated with assessing information security risk across an organization?

$1.$

A high$-$level overview of the risk management process and the role risk assessments play in that process.

$2.$

Basic concepts used in conducting risk assessments.

$3.$

Detailed operating procedures that define how IT works across the organization.

$4.$

How risk assessments can be applied across the organization$$s risk management tiers