Determining actual risks is complicated and time consuming...

Determining actual risks is complicated and time consuming to perform, which is why RSEI was developed as a risk-screening and priority-setting tool, and it should not be used to make determinations of actual risk.