The SAQ has three risk categories: low, medium, and high