https://123dok.net/document/yr366lno-combining-information-security-risk-management-probabilistic-risk-assessment.html