What are the primary steps in cyber risk management for an enterprise network?

What are the primary steps in cyber risk management for an enterprise network?

• A. Identify assets and threats, assess vulnerabilities and risk, implement controls and mitigations, and monitor and review risk.
• B. Deploy more servers, hire more staff, and increase training budgets.
• C. Ignore risk; patch only when required.
• D. Risk management is only about compliance paperwork.

Answer: (A)

Cyber risk management in an enterprise network follows a lifecycle that starts with knowing what you have and what could threaten it, then assessing how exposed you are, putting in place protections, and continuously watching for changes. The first step is identifying assets and threats—take an inventory of critical systems, data, and services, and consider who or what might meaningfully threaten them (for example, adversaries, misconfigurations, or supply-chain risks). Next, assess vulnerabilities and risk by evaluating how likely those threats are to exploit weaknesses and what the potential impact would be on operations, data, and reputation. With that understanding, you implement controls and mitigations to reduce risk, which includes technical measures like patching, configuration management, access controls, and network segmentation, as well as administrative actions such as policies and training. Finally, you monitor and review risk on an ongoing basis, rechecking the asset landscape, updating risk scores, validating control effectiveness, and adjusting defenses as the environment or threat picture evolves. This continuous cycle aligns with established risk management practices and ensures protection adapts to changes rather than remaining static. The other approaches don’t address this structured, ongoing process. Merely expanding resources or training without a risk-focused plan misses the evaluation and prioritization; ignoring risk and patching only when required is reactive and leaves gaps; treating risk management as solely paperwork reduces it to bureaucracy instead of ongoing protection.

Cyber risk management in an enterprise network follows a lifecycle that starts with knowing what you have and what could threaten it, then assessing how exposed you are, putting in place protections, and continuously watching for changes. The first step is identifying assets and threats—take an inventory of critical systems, data, and services, and consider who or what might meaningfully threaten them (for example, adversaries, misconfigurations, or supply-chain risks). Next, assess vulnerabilities and risk by evaluating how likely those threats are to exploit weaknesses and what the potential impact would be on operations, data, and reputation. With that understanding, you implement controls and mitigations to reduce risk, which includes technical measures like patching, configuration management, access controls, and network segmentation, as well as administrative actions such as policies and training. Finally, you monitor and review risk on an ongoing basis, rechecking the asset landscape, updating risk scores, validating control effectiveness, and adjusting defenses as the environment or threat picture evolves. This continuous cycle aligns with established risk management practices and ensures protection adapts to changes rather than remaining static.

The other approaches don’t address this structured, ongoing process. Merely expanding resources or training without a risk-focused plan misses the evaluation and prioritization; ignoring risk and patching only when required is reactive and leaves gaps; treating risk management as solely paperwork reduces it to bureaucracy instead of ongoing protection.