Which basic step in risk analysis should be performed first?

• A. Identify threats
• B. Assessment and evaluation
• C. Establish baselines
• D. Determine cost-effective strategy

Answer: (B)

Starting with assessing and evaluating sets up the context for risk analysis. This step helps you understand what needs protection, which assets matter, what level of risk is acceptable, and the current risk posture. It also establishes baselines so you have a reference point to measure improvements or changes against. With that context in place, you can meaningfully identify threats, gauge their likelihood and potential impact, and determine where resources should be focused. Jumping straight into listing threats or deciding on strategies without first assessing the overall risk can lead to chasing irrelevant issues or misallocating defenses.