This sample document provides some criteria to consider when you build a risk assessment security questionnaire. It is not an exhaustive list and should not be treated as such. The weight assigned to an individual question depends on your business needs. Every question in each category can be mapped to a numeric score value, and all scores are then added together to identify the bucket that the application belongs to.