Vulnerability and Control Deficiency Analysis CISM Domain 2 — Information Security Risk Management A — Information Security Risk Assessment 9–11 minutes