CGEIT · Question #330
When establishing a risk management process which of the following should be the FIRST step?
The correct answer is C. Identify assets. The first step in establishing a risk management process is to identify the assets that need protection, as the value and nature of these assets drive all subsequent risk analysis activities.
Question
When establishing a risk management process which of the following should be the FIRST step?
Options
- ADetermine the probability of occurrence
- BIdentify threats
- CIdentify assets
- DAssess risk exposures
How the community answered
(25 responses)- A4% (1)
- B4% (1)
- C92% (23)
Why each option
The first step in establishing a risk management process is to identify the assets that need protection, as the value and nature of these assets drive all subsequent risk analysis activities.
Determining the probability of occurrence is a step in risk assessment, which comes after assets, threats, and vulnerabilities have been identified.
Identifying threats is a crucial step in risk management, but it logically follows the identification of assets, as threats are only relevant in the context of what they can harm.
Before evaluating threats, vulnerabilities, or potential impacts, an organization must first identify and understand its critical assets (e.g., information, systems, people, facilities). This foundational step defines what needs to be protected, establishing the scope for the entire risk management process.
Assessing risk exposures involves evaluating the likelihood and impact of risks, which is a later step in the risk assessment process, performed after assets, threats, and vulnerabilities are known.
Concept tested: Risk management process initiation
Source: https://learn.microsoft.com/en-us/security/benchmark/azure/governance-risk-compliance-risk-assessment
Topics
Community Discussion
No community discussion yet for this question.