Which one of the following is not considered to be a component of a standard risk framework? Question 25 options: risk analysis root cause analysis threat analysis vulnerability assessment Inherent risk classification (asset value)