A risk model is being documented for a new programme. Which items does NIST SP 800-30 list as the typical risk factors such a model works with? Choose three.

Answer: C. Threat and vulnerability.
A. Likelihood and impact.
B. Predisposing condition.

SP 800-30 names threat, vulnerability, likelihood, impact and predisposing condition as typical risk factors. Appetite and tolerance belong to the risk frame, not to the model's factors.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3.1 Risk Models