IT Examiner School

Question What is the first step in developing an information security program’s risk assessment? A. Identify threats B. Identify assets C. Identify controls D. Assign residual risk

Risk Assessment Process - Overview Information & value sensitivity of information assets Identify potential internal/external threats and/or vulnerabilities Assess likelihood & impact of threats/vulnerabilities Assess sufficiency of risk control policies, procedures, information systems, etc.