Which of the following is MOST important to consider when prioritizing threats during the risk assessment process?

The correct answer is D. The potential impact on operations. The primary goal of risk assessment is to protect business operations. 'Potential impact on operations' is the most critical prioritization factor because it directly determines how much harm a threat can cause to the organization. A threat with devastating operational impact…

Submitted by brentm· Apr 18, 2026Information Security Risk Management

Question

Options

ARegulatory requirements on the organization
BThe severity of exploited vulnerabilities
CThe threat landscape within the industry
DThe potential impact on operations

How the community answered

(43 responses)

A
2% (1)
B
5% (2)
C
14% (6)
D
79% (34)

Explanation

The primary goal of risk assessment is to protect business operations. 'Potential impact on operations' is the most critical prioritization factor because it directly determines how much harm a threat can cause to the organization. A threat with devastating operational impact demands immediate attention regardless of regulatory context, technical severity, or industry trends. The other options-regulatory requirements (A), exploited vulnerability severity (B), and industry threat landscape (C)-are inputs that inform risk analysis, but impact on operations is what ultimately drives prioritization decisions because it aligns risk management with business objectives.

Topics

#Risk Prioritization#Risk Assessment#Impact Analysis#Threat Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice