A.Likelihood and impact of the risk scenario

B.Historical losses due to past risk events

C.Actor and threat type of the risk scenario

D.Cost to reduce the impact and likelihood

A.Conduct a feasibility study

B.Acquire software

C.Define requirements of project

D.Plan project management

E.Explanation:
Conducting a feasibility study begins once initial approval has been given to move forward with a project. It includes an analysis to clearly define the need and to identify alternatives for addressing
the need.

F.is incorrect. Acquiring software involves building new or modifying existing hardware or
software after final approval by the stakeholder, which is not a phase in the standard SDLC
process.
If a decision was reached to acquire rather than develop software, this task should occur after
feasibility study and defining requirements.

G.is incorrect. This is latter phase in project development process.

A.Recording and tracking the status of risk response plans within the register.

B.Communicating the register to key stakeholders.

C.Performing regular reviews and updates to the register.

D.Removing entries from the register after the risk has been treated.

A.Escalate the issue to senior management

B.Discuss risk mitigation options with the risk owner.

C.Implement compensating controls to reduce residual risk

D.Certify the control after documenting the concern.

A.Corporate risk profile

B.Management's expectations

C.Recent security incidents

D.The current risk management capability