In ICT security, which method is commonly used to prioritize controls by likelihood and impact?

In ICT security, which method is commonly used to prioritize controls by likelihood and impact?

• A. Threat modeling
• B. Risk matrix
• C. Backups schedule
• D. User access review

Answer: (B)

Prioritizing security controls by likelihood and impact is done with a risk matrix. In ICT security, you identify the assets to protect, assess how likely a given threat is to occur, and estimate the potential harm if it does. By plotting these factors on a matrix that crosses likelihood with impact, you assign a risk level to each threat. This risk rating guides where to focus controls first, allocating resources to the highest-risk areas to reduce overall exposure. Threat modeling helps uncover threats and attack paths, but it doesn’t inherently provide the structured likelihood-by-impact prioritization that a risk matrix offers. Backups scheduling and user access reviews are important controls themselves, yet they aren’t the framework used to rank all controls by risk.

Prioritizing security controls by likelihood and impact is done with a risk matrix. In ICT security, you identify the assets to protect, assess how likely a given threat is to occur, and estimate the potential harm if it does. By plotting these factors on a matrix that crosses likelihood with impact, you assign a risk level to each threat. This risk rating guides where to focus controls first, allocating resources to the highest-risk areas to reduce overall exposure. Threat modeling helps uncover threats and attack paths, but it doesn’t inherently provide the structured likelihood-by-impact prioritization that a risk matrix offers. Backups scheduling and user access reviews are important controls themselves, yet they aren’t the framework used to rank all controls by risk.