time-consuming activity that there are often no time, resources, or motivation
to extend the risk assessment to the lower level of granularity required to assess
individual software components of the system.
Systems risk analysts, then, generally proceed without consulting the