Which term is about reducing risk to an acceptable level through a security program?

Which term is about reducing risk to an acceptable level through a security program?

• A. Risk Treatment
• B. Risk Management
• C. Cyber Threat Intelligence
• D. Risk Assessment

Answer: (B)

Reducing risk to an acceptable level through a security program is the work of risk management. This involves the ongoing process of identifying risks, evaluating their potential impact, prioritizing which risks to address, and implementing controls and measures to lower those risks to acceptable levels. The security program provides the safeguards—like access controls, patching, monitoring, and incident response—that actually reduce risk and allow the organization to operate within its risk appetite. Risk assessment, by contrast, is about identifying and analyzing risks, not applying controls. Cyber threat intelligence focuses on gathering and analyzing information about threats to inform defenses. Risk treatment refers specifically to the actions chosen to mitigate risk, which is part of risk management but not the entire discipline on its own.

Reducing risk to an acceptable level through a security program is the work of risk management. This involves the ongoing process of identifying risks, evaluating their potential impact, prioritizing which risks to address, and implementing controls and measures to lower those risks to acceptable levels. The security program provides the safeguards—like access controls, patching, monitoring, and incident response—that actually reduce risk and allow the organization to operate within its risk appetite.

Risk assessment, by contrast, is about identifying and analyzing risks, not applying controls. Cyber threat intelligence focuses on gathering and analyzing information about threats to inform defenses. Risk treatment refers specifically to the actions chosen to mitigate risk, which is part of risk management but not the entire discipline on its own.