A risk-based approach should make security measures traceable to the risks they are intended to address.

### Why this is right Traceability shows why a measure was selected and which exposure it is meant to reduce. This helps decision-makers check whether safeguards match priorities. ### The concept Risk-based security begins with assets and possible harms, then selects safeguards in response. A control without a clear relationship to a risk may consume resources without addressing the most important exposure. Organizations should review whether measures remain suitable as conditions change. ### The other options - **False**: this would disconnect security measures from the risks they are intended to manage. ### Terms - **Risk-based approach**: Selecting security measures according to assessed risks and priorities. - **Traceability**: The ability to connect a decision or control to its purpose. ### Remember Be able to explain which risk each security measure addresses.