[Suggestion] AssetRisk.privacy

[izar]

Extend AssetRisk to have a privacy attribute so it doesn't need to be conflated with confidentiality and can be explicitly called out.

[jgadsden]

This would be good to have, I agree with @izar that we could extend the schema here:

                    "properties": {
                        "confidentiality": {"type": "number"},
                        "integrity": {"type": "number"},
                        "availability": {"type": "number"},
                        "comment": {"type": ["string", "null"]}
                    }

so that we can support risk in a wider sense than CVSS scores