A Two-Level Model for Describing the Risk Profile in Formulating Policy and Developing Security Capabilities In IT4Sec Reports. Sofia: Institute of Information and Communication Technologies, 2015.