Which additional element is needed to calculate the risk?

A company’s web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities .

Which additional element is needed to calculate the risk?
A . assessment scope
B . event severity and likelihood
C . incident response playbook
D . risk model framework

Answer: D