This module defines “simple risk,” using this definition to drive an analysis of the telecommunications industry. Also discusses the limitations of this definition, especially when considering human-made incidents, versus random accidents. Uses the 1995 Oklahoma Federal Building bombing as an example of risk due to human-caused incident. Also discusses Return-On-Investment (ROI), an extension of risk that incorporates a cost-benefit factor. Finally, addresses how risk affects the decisions made by policymakers, and suggests effective ways for policymakers to get the most “bang for the buck” in terms of protecting and hardening critical infrastructure (CI).