Which term best defines the process of identifying assets and threats as the first step in cyber risk management?

Which term best defines the process of identifying assets and threats as the first step in cyber risk management?

• A. Identify assets and threats.
• B. Patch management of vulnerabilities.
• C. Deploy and harden endpoints.
• D. Monitor and review risk.

Answer: (A)

The key idea here is starting risk management by establishing what you need to protect and what could harm those things. Identifying assets—like systems, data, and people—and the threats they face sets the boundary of the risk landscape. With that foundation, you can then assess vulnerabilities, evaluate risk levels, and decide on mitigations. The other actions—patching vulnerabilities, deploying and hardening endpoints, and continuously monitoring and reviewing risk—are important parts of the risk-management lifecycle, but they come after you’ve identified what and who needs protection and what could harm them. So the term that best fits the first step is simply identifying assets and threats.

The key idea here is starting risk management by establishing what you need to protect and what could harm those things. Identifying assets—like systems, data, and people—and the threats they face sets the boundary of the risk landscape. With that foundation, you can then assess vulnerabilities, evaluate risk levels, and decide on mitigations. The other actions—patching vulnerabilities, deploying and hardening endpoints, and continuously monitoring and reviewing risk—are important parts of the risk-management lifecycle, but they come after you’ve identified what and who needs protection and what could harm them. So the term that best fits the first step is simply identifying assets and threats.