Which basic step in risk analysis should be performed second?

• A. Identify threats
• B. Assessment and evaluation
• C. Determine cost-effective strategy
• D. Backup planning

Answer: (A)

Understanding risk analysis follows a logical sequence: you start by identifying what needs protection—your assets. Once you know what you’re protecting, the next essential step is to identify the threats that could affect those assets. This is necessary because risk is evaluated based on the combination of threats and the potential impact if those threats materialize. Without listing the threats, you can’t accurately assess risk or determine where controls are most needed. After threats are identified, you move on to assessment and evaluation to quantify risk, then decide on cost-effective strategies and plan backups as part of implementing appropriate controls.