ITPEC FE Morning October 2019 Question 44

Risk identification, risk analysis and risk evaluation — these three processes make up risk assessment in ISO 31000 and ISO/IEC 27005.

Risk management runs: establish the context, then risk assessment, then risk treatment, with monitoring and communication throughout. Risk assessment itself has three steps:

1. Risk identification — find the risks: assets, threats, vulnerabilities and what could happen
2. Risk analysis — work out the likelihood and consequence of each risk, which give its level
3. Risk evaluation — compare the levels with the risk criteria and decide which risks need treatment and in what order

Response and acceptance come after this, in risk treatment.

Answer (c)

Why not others:

• •(a) — leaves out risk identification and adds risk response, which is risk treatment
• •(b) — leaves out identification and evaluation, and both response and acceptance are treatment decisions
• •(d) — leaves out risk analysis, without which there is no risk level to evaluate, and adds acceptance, a treatment option

Key rule: Assessment finds and ranks risks (identify, analyse, evaluate); treatment decides what to do about them (avoid, reduce, transfer, accept).

Security · AI-written, may contain errors