A security architect must decide where to focus limited resources when modernizing an organization's security architecture. Leadership wants a repeatable, evidence-based way to choose which risks to mitigate first. According to Microsoft guidance on data-driven prioritization, which three factors should drive that prioritization?