It is not specific because it focuses on a rating that is one level removed from the risk itself and, as an abstraction of the seriousness of the underlying issue, represents the technology risk manager’s perspective, which may not be shared by others.