Which sequence correctly lists the primary steps in a generic IT risk assessment?

• A. Identify assets; implement controls; monitor outcomes; report failure; replace systems.
• B. Identify assets and threats; determine vulnerability; analyze likelihood and impact; assess existing controls; determine residual risk; prioritize; plan mitigation and monitoring.
• C. Determine budget; hire staff; deploy hardware; test.
• D. Scan network; log events; respond to incidents; review annually.

Answer: (B)