layers or nodes. These attributes can be classified as either probability-relevant,
size-of-loss relevant, or descriptive. These class attributes are primarily derived
from NIST SP 800-30, Risk Management Guide for Information Technology
Systems, and the Common Vulnerability Scoring System (CVSS). [191]