Why is risk assessment important in ICT security, and name a common method used.

Why is risk assessment important in ICT security, and name a common method used.

• A. Identifies hardware maintenance needs.
• B. Prioritizes controls by budget only.
• C. Assesses user satisfaction metrics.
• D. Identifies threats and vulnerabilities to prioritize controls; common method: risk matrix.

Answer: (D)

In ICT security, risk assessment helps identify threats and vulnerabilities so you can prioritize the security controls that will reduce the greatest risk. By understanding where weaknesses lie and how likely they are to be exploited, you can allocate limited resources to the protections that will have the biggest impact on overall security and resilience, and you can track how risk changes over time as the environment evolves. A common method used is the risk matrix, which combines likelihood and potential impact to rate risks as high, medium, or low. This makes it clear which controls to implement first and how to adjust priorities as new threats emerge. The other options miss the security-focused purpose: they look at maintenance, budgeting, or user metrics rather than identifying threats and guiding risk-based defenses.

In ICT security, risk assessment helps identify threats and vulnerabilities so you can prioritize the security controls that will reduce the greatest risk. By understanding where weaknesses lie and how likely they are to be exploited, you can allocate limited resources to the protections that will have the biggest impact on overall security and resilience, and you can track how risk changes over time as the environment evolves. A common method used is the risk matrix, which combines likelihood and potential impact to rate risks as high, medium, or low. This makes it clear which controls to implement first and how to adjust priorities as new threats emerge. The other options miss the security-focused purpose: they look at maintenance, budgeting, or user metrics rather than identifying threats and guiding risk-based defenses.