A risk register lists only malicious attacks. Which additional sources should be considered?

1. Only events that have already happened internally
2. Only additional malware families
3. Every imaginable event regardless of plausibility
4. Relevant errors, process failures, environmental events, and dependency outages