Which sequence correctly lists the primary steps in a generic IT risk assessment?

Which sequence correctly lists the primary steps in a generic IT risk assessment?

• A. Identify assets; implement controls; monitor outcomes; report failure; replace systems.
• B. Identify assets and threats; determine vulnerability; analyze likelihood and impact; assess existing controls; determine residual risk; prioritize; plan mitigation and monitoring.
• C. Determine budget; hire staff; deploy hardware; test.
• D. Scan network; log events; respond to incidents; review annually.

Answer: (B)

A risk assessment in IT starts with identifying what needs protection and the threats it faces, along with the vulnerabilities that could be exploited. Then you estimate how likely those risks are and how severe the impact would be if they occur. After that, you evaluate the controls you already have and determine the residual risk remaining after those controls are in place. With that residual risk, you prioritize what needs attention and plan the mitigation actions plus how you will monitor results over time. This approach ensures you make informed decisions about where to invest in controls and how to track their effectiveness. The other sequences skip essential assessment steps or shift focus to implementation, budgeting, or incident response rather than the risk assessment process itself.

A risk assessment in IT starts with identifying what needs protection and the threats it faces, along with the vulnerabilities that could be exploited. Then you estimate how likely those risks are and how severe the impact would be if they occur. After that, you evaluate the controls you already have and determine the residual risk remaining after those controls are in place. With that residual risk, you prioritize what needs attention and plan the mitigation actions plus how you will monitor results over time. This approach ensures you make informed decisions about where to invest in controls and how to track their effectiveness. The other sequences skip essential assessment steps or shift focus to implementation, budgeting, or incident response rather than the risk assessment process itself.