1. a company is beginning a risk assessment for a system. both the characteristics and the mission of the system should be defined in the early stages of the risk assessment.