Which sequence best describes a risk assessment?

Which sequence best describes a risk assessment?

• A. Identify assets, threats, vulnerabilities; evaluate likelihood and impact; determine controls; implement; monitor
• B. Implement controls first; then identify assets
• C. Ignore threats and just focus on backups
• D. Only assess financial risk

Answer: (B)

A risk assessment is a stepwise process that first builds an understanding of what needs protection and what could threaten it, so that you can measure risk accurately and choose appropriate safeguards. The best sequence starts with identifying assets, the threats they face, and any vulnerabilities that could be exploited. Next, you evaluate the likelihood of those threats materializing and the potential impact if they do. With that risk picture, you determine which controls are needed, implement them, and then continuously monitor to catch new threats or changes in the environment. Choosing to implement controls before identifying what’s at risk skips the critical groundwork and can lead to mismatched or ineffective safeguards. Focusing only on backups ignores the broader spectrum of risk, including threats and vulnerabilities that backups alone don’t address. Narrowing the view to financial risk misses other important assets and risk types that need consideration.

A risk assessment is a stepwise process that first builds an understanding of what needs protection and what could threaten it, so that you can measure risk accurately and choose appropriate safeguards. The best sequence starts with identifying assets, the threats they face, and any vulnerabilities that could be exploited. Next, you evaluate the likelihood of those threats materializing and the potential impact if they do. With that risk picture, you determine which controls are needed, implement them, and then continuously monitor to catch new threats or changes in the environment.

Choosing to implement controls before identifying what’s at risk skips the critical groundwork and can lead to mismatched or ineffective safeguards. Focusing only on backups ignores the broader spectrum of risk, including threats and vulnerabilities that backups alone don’t address. Narrowing the view to financial risk misses other important assets and risk types that need consideration.