Which concept is the formal process of evaluating and prioritizing security risks by considering both probability and impact?

• A. Policy
• B. Privacy Shield
• C. Risk Management
• D. Regulations

Answer: (C)

Risk management is the formal process of evaluating and prioritizing security risks by considering both probability and impact. It begins with identifying assets, threats, and vulnerabilities, then assessing how likely a threat is to exploit a vulnerability and the potential consequences if it does. By weighing likelihood against potential harm, risks are ranked so that resources focus on the highest-priority areas. The process leads to selecting and implementing appropriate risk treatment options—such as applying controls, transferring risk, accepting it, or avoiding it—and ongoing monitoring of residual risk. This approach ensures security measures are proportional to risk and decisions are documented and repeatable. Policies describe rules, privacy shield is a data protection framework for cross-border data transfer, and regulations are legal requirements; none of these capture the full, formal process of evaluating and prioritizing risks based on probability and impact.