A.perform a risk analysis on the risk scenarios.

B.reduce the number of risk scenarios to a manageable set.

C.record risk scenarios in the risk register for analysis.

D.validate the risk scenarios for business applicability.

A.Identify roles and responsibilities for security controls.

B.Conduct risk assessment peer reviews.

C.Determine and understand the risk rating of scenarios.

D.Engage a third party to perform a risk assessment.

A.real-time monitoring of risk events and control exceptions.

B.Perform a controls assessment.

C.procedures to monitor the operation of controls.

D.a tool for monitoring critical activities and controls.

E.monitoring activities for all critical assets.

A.Risk control assessment

B.Business impact analysis (BIA)

C.Audit reports with risk ratings

D.Penetration test results

A.Corporate risk appetite is communicated to staff members.

B.Risk owners understand and accept accountability for risk.

C.Risk policy has been published and acknowledged by employees.

D.Management encourages the reporting of policy breaches.