A First-Principles Based Risk Assessment Framework and the IEEE P3396 Standard