An IT security analyst conducts a process of risk identification and assessment using NIST's Managing Information Security Risk principles as a guide. Which function sets an overall goal for the degree of risk tolerated and demarcates responsibilities