A company is starting its first formal risk management program and wants to begin with risk identification. Which activity should come first?
Select an answer to reveal the explanation.
Short Explanation
You can't protect what you don't know you have, and you can't fix risk nobody owns. So step one is a list of assets with a name next to each. The trap is jumping to ALE math or insurance, which are later steps that need that list first.
Full Explanation
Risk identification starts by establishing what the organization needs to protect and who is accountable for it. Asset identification builds an inventory of systems, data, applications, facilities, and processes, and stakeholder ownership assigns each asset to a business owner who understands its value and is accountable for decisions about its risk. Threats and vulnerabilities can then be identified against specific assets, and every later step, including analysis, scoring, treatment, and register entries, references those assets and owners. Calculating annualized loss expectancy is a quantitative analysis step; it requires an asset value, an exposure factor, and an annual rate of occurrence, none of which exist before assets are identified and valued. Purchasing cyber insurance is a risk treatment, specifically transfer, and choosing a treatment before knowing the risks wastes money and may cover the wrong exposures. Setting acceptable residual risk relates to risk appetite and treatment decisions, which leadership makes after risks have been analyzed; doing it first means defining tolerances for risks nobody has described. Exam caveat: asset discovery should include data and third-party services, not just hardware, because many significant risks sit outside the data center. Operational check: confirm every asset in the new inventory has a named owner, then hold owner workshops to record threats against each asset.