Arrange the stages of addressing a newly identified cyber risk in the correct chronological sequence, from first to last.

### The order 1. **Identify relevant assets and organisational dependencies**: risk cannot be assessed without knowing what is exposed or relied upon. 2. **Assess the risk and its possible effect on services**: evaluation establishes why the issue matters. 3. **Choose an appropriate risk-management response**: the organisation decides how to treat the risk. 4. **Select supporting protective or monitoring initiatives**: actions translate the decision into work. 5. **Measure and review whether the chosen work is effective**: review shows whether outcomes are being achieved and whether plans need adjustment. ### The concept This is a planning sequence rather than a claim that every operational security task follows one rigid workflow. The key logic is to understand the risk before selecting controls, then check whether the response works. ### Remember Understand and assess first, act second, and review the result.