Which of the following is not part of information security risk analysis?

Question $71$ options:

Determining which data need protecting

Backing up the data

Identifying the risks to the data

Calculating the likelihood that a risk may become a reality