Which areas are identified as considerations for Identify and Manage? Select ALL that apply.

### Why this is right - **Asset management** is correct because the organisation needs to identify and understand its information systems and assets. - **Business environment** is correct because cyber risk must be understood in relation to the organisation’s services and context. - **Supply-chain risk management** is correct because vendors and suppliers can introduce or share risk. ### The concept Identify and Manage provides the organisational understanding needed to set priorities. Governance, risk assessment, and risk-management strategy also belong to this area. Incident communications are more directly associated with response planning, although communication may matter across the wider strategy. ### The other options - **D. Incident communications**: this is a response consideration, not one of the listed Identify and Manage areas. ### Terms - **Asset**: an item of value to the organisation, such as data, a system, or equipment. - **Governance**: the roles and oversight used to direct organisational decisions. ### Remember Identify and Manage is about understanding the organisation and its risks before selecting safeguards.