An administrator wants to perform a risk assessment without using proprietary company information. Which of the following methods should the administrator use t...