5.1.2.2 Define thresholds for each risk category