which of the following items should be included?

When compiling a risk assessment report, which of the following items should be included?
(Choose all that apply)

A.
Vulnerability levels

B.
Method of attack used

C.
Names of frequent security violators

D.
Data sensitivity levels

E.
ALE calculations