Information security risk assessments have become one of the more important techniques to minimize operational risk, improve the security posture in a company, and meet current regulations and standards. Risk assessments have long been used in other domains, such as software and system development and the financial and insurance industries. In information security, risk assessments began as primarily technological evaluations -- an identification of the known [1] vulnerabilities remaining in operational systems and system components.