A business unit is about to perform its first information security risk assessment, and the scope has been agreed with management. Which step should come FIRST?
Select an answer to reveal the explanation.
Short Explanation
You can't guess what a burglar wants until you know what's in the house and what it's worth. So once scope's agreed, you identify assets and their value before you look at threats or weaknesses. The trap is diving into scans or controls before you know what you're protecting.
Full Explanation
Risk is always risk to something, so a risk assessment begins, within an agreed scope, by identifying the information assets involved and establishing their value or criticality to the business, usually with the asset owners. Asset value determines the potential impact of any scenario and tells the assessors where to concentrate the threat and vulnerability analysis that follows. Identifying likely threats is an essential step, but threats are meaningful only in relation to particular assets; without the asset list, threat analysis has no anchor and cannot be prioritized. Scanning for vulnerabilities is a technical activity that also needs a defined asset scope, and a list of weaknesses on systems of unknown value does not indicate risk. Selecting controls is treatment, which comes after risk has been analyzed and evaluated against appetite; choosing controls first assumes the outcome of the assessment. Exam caveat: establishing context and scope precedes asset identification, and the stem states that this has already been done. Operational check: confirm the assessment working papers contain an asset inventory with owners and valuations before any threat, vulnerability or treatment section.