How do you conduct a basic risk assessment for a new system?

How do you conduct a basic risk assessment for a new system?

• A. Identify assets, threats, vulnerabilities; assess likelihood and impact; select and implement controls; document.
• B. Ignore threats and hope for best.
• C. Focus only on technical controls without asset inventory.
• D. Skip documentation to save time.

Answer: (A)

Beginning with what you need to protect, what could go wrong, and where the weaknesses are is essential for a basic risk assessment. Start by mapping assets—data, systems, users, and physical infrastructure—then identify potential threats and the vulnerabilities that could be exploited. Next, estimate how likely each risk is and how big the impact would be if it occurred, so you can prioritize where to focus controls. Finally, select and implement appropriate safeguards and document the entire process to ensure the assessment can be reviewed, updated, and traced as the system evolves. This approach is thorough because it covers the full risk-management loop: knowing what exists, understanding what could harm it, quantifying the risk to guide action, and recording decisions for accountability. The other options miss critical pieces—ignoring threats, skipping asset inventories, focusing only on one aspect like technical controls, or omitting documentation—undermining the ability to reduce risk effectively.

Beginning with what you need to protect, what could go wrong, and where the weaknesses are is essential for a basic risk assessment. Start by mapping assets—data, systems, users, and physical infrastructure—then identify potential threats and the vulnerabilities that could be exploited. Next, estimate how likely each risk is and how big the impact would be if it occurred, so you can prioritize where to focus controls. Finally, select and implement appropriate safeguards and document the entire process to ensure the assessment can be reviewed, updated, and traced as the system evolves.

This approach is thorough because it covers the full risk-management loop: knowing what exists, understanding what could harm it, quantifying the risk to guide action, and recording decisions for accountability. The other options miss critical pieces—ignoring threats, skipping asset inventories, focusing only on one aspect like technical controls, or omitting documentation—undermining the ability to reduce risk effectively.