Explain how a risk assessment informs an incident response plan. Include the kinds of questions the organization should investigate.

### The concept A risk assessment is an input to planning, not a substitute for the plan. It identifies information and systems of value, then considers how likely they are to be compromised and what the consequences would be. The organization can use those results to direct preparation and response resources toward higher-priority risks. It should ask what data is valuable, which business areas handle sensitive data, what controls already exist, and whether an incident could cause a privacy breach. ### What a good answer covers - Identifies valuable organizational assets, including information and systems. - Considers both the likelihood and impact of compromise. - Reviews existing controls and business areas that handle sensitive data. - Explains that the assessment helps prioritize response efforts and consider privacy consequences. ### Terms - **Sensitive data**: Information that requires careful protection because of its nature or the consequences of exposure. - **Privacy breach**: An incident involving harm to, or unauthorized exposure of, personal or otherwise protected information. ### Remember A useful plan follows the risks the organization has actually identified.