CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following should be the initial step when conducting a risk analysis for an asset?

A Assess controls.
B Assess risk scenarios.
C Evaluate threats.
D Update the risk register.

Explanation

Risk analysis for an asset starts by evaluating relevant threats, because threats establish the potential adverse events that may exploit vulnerabilities and cause impact. Risk scenarios, control assessments, and risk-register updates follow from that analysis.

Learn more

NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1398

Community Discussion