Explain how likelihood, impact, controls, and residual risk fit into a documented cyber risk assessment.

### The concept A risk assessment first establishes what information assets need protection and who owns them. It then identifies threats, which are possible causes of harm, and vulnerabilities, which are weaknesses a threat could exploit. Likelihood estimates how probable a harmful scenario is, while impact describes the severity of its effects. Controls are selected to lower the exposure, but the organization must reassess after applying them. The remaining exposure is residual risk, which should be documented rather than assumed to be zero. ### What a good answer covers - Identifies assets, owners, threats, and vulnerabilities. - Distinguishes likelihood from impact. - Explains that controls aim to reduce risk. - Defines residual risk as what remains after controls and reassessment. ### Terms - **Residual risk**: Risk remaining after controls are applied. - **Control**: A technical or administrative measure intended to reduce risk. ### Remember Likelihood estimates probability; impact describes severity.