What process facilitates the balance of operational and economic costs of protective measures with gains in mission capability?

Risk assessment is only a subset component of risk management focused on identifying and evaluating risks, not the broader process of balancing costs against mission capability gains.

Performance testing evaluates the functionality and efficiency of systems under load conditions and does not address the economic or operational trade-offs of security protective measures.

A security audit is a point-in-time evaluation of an organization's security posture against defined standards or policies, and does not encompass the ongoing balancing of costs and mission capability.

Risk management is the overarching process that weighs the operational and economic costs of implementing security controls against the benefits gained in mission capability and risk reduction. It involves decision-making frameworks that help organizations allocate limited resources to protective measures in a cost-effective manner, ensuring mission objectives are met while maintaining an acceptable risk posture.