Which statement best describes the main components of a cybersecurity risk assessment?

• A. Identify assets, threats, and vulnerabilities; assess likelihood and impact; prioritize risks; select controls to treat them; and monitor residual risk over time.
• B. Define incident response playbooks and runbooks.
• C. Implement patch management across all systems.
• D. Measure network throughput and performance.

Answer: (A)

A solid cybersecurity risk assessment focuses on understanding what needs protection, what could threaten it, and how to respond in a measured, ongoing way. It starts with identifying what you have to protect—assets such as data, systems, and people—and then identifying potential threats and the vulnerabilities that could be exploited. Next comes evaluating how likely those threats are and how big the impact would be if they occurred, which lets you prioritize risks based on their severity and probability. With that prioritization, you choose appropriate controls or mitigations to reduce risk and decide how you’ll treat each risk, whether by applying preventive measures, adding detection, transferring or sharing risk, or accepting it. Finally, you continuously monitor the remaining risk after controls are in place, because the environment and threats evolve over time and periodic reassessment is essential.

This set of steps is what makes the risk assessment approach comprehensive and actionable. Other options refer to activities that are important in security practice but do not capture the full risk assessment process: incident response playbooks describe how to react to incidents, not how to evaluate and prioritize risk; patch management is a specific control activity, not the full assessment lifecycle; and measuring network throughput is about performance metrics, not risk identification and treatment.