In our risk analysis, we are looking at the risks, vulnerabilities, and threats. We use the asset value to determine appropriate countermeasures. Which type of risk analysis are we using?