When Assessing a vulnerability in conjunction with the threat and then determining the impact this would have on an operation if the vulnerability is exploited determines the level of risk?