In disaster recovery risk analysis, threats and vulnerabilities are measured by their impact and probability. A lot of methods I’ve seen have probability defined as high, medium, and low and associated with a number. Is there a definition for highmedium and low (e.g., low = rarely or never occurs)