1. A computer-implemented method for performing risk analysis of a computer system including a plurality of components, comprising: in memory, storing a product catalog storing product reference data for the components of the computer system; with a computer device, running a rules service engine for applying rules to the computer system; identifying one of the rules to the rules service engine, wherein the identified rule is associated with a set of components for analysis of the identified rule; using the rules service engine to communicate with the product catalog to retrieve a set of contributing factors associated with each of the components in the set of analysis components; collecting input data from the set of analysis components in the computer system; executing the identified rule based on the collected input data and based on the set of contributing factors; and prior to the collecting of the input data, determining the set of contributing factors is incomplete for a particular component in the set of analysis components with regard to data needed to perform the executing of the identified rule and, in response, accessing one or more referential sources to identify data associated with the particular component, wherein the executing of the identified rule is further based on the identified data from the referential sources.