In terms of determining the risk to your organization, how do you set about assigning probability and cost metrics to determine the appropriate mitigation strategies?