Which option best describes a cybersecurity assessment?

### Why this is right An assessment systematically examines what the organization must protect, what may threaten it, where weaknesses exist, and what controls could address the resulting risks. This matches the definition in the course material. ### The concept A **control** is a measure used to reduce risk, such as an access restriction or a testing procedure. An assessment supplies evidence for decisions about controls and priorities. It does not itself implement every control or guarantee that a breach cannot occur. ### The other options - **B. A guarantee that all security incidents will be prevented**: an assessment identifies and evaluates concerns, but cannot promise that incidents will never happen. - **C. A list of technical products selected for purchase**: products may be considered later, but the assessment is broader and starts with risks and needs. - **D. A record of incidents that have already caused financial loss**: incident records may inform an assessment, but an assessment also considers potential future harm. ### Terms - **Cybersecurity assessment**: a structured examination of security concerns used to inform decisions. - **Asset**: something valuable to an organization that needs protection. - **Threat**: a potential cause of harm. - **Vulnerability**: a weakness that a threat could exploit. - **Risk**: the possibility of harm and its consequences. - **Control**: a measure intended to manage risk. ### Remember An assessment identifies and evaluates risk; it does not guarantee risk elimination.