题目内容：
（ ） is not included in Information Security Risk Assessment Process.
A.Establishing information security risk criteria
B.Identifying the information security risks
C.Formulating an information security risk treatment plan
D.Analysing the information security risk
参考答案：【答案仅供学习，请勿对照自行用药等】
答案解析：