Arrange the stages of the standard cyber risk assessment and mitigation lifecycle in chronological order, from first to last.

### Why this is right The sequence first establishes what must be protected, then identifies possible attackers and weaknesses. Initial risk is assessed before controls are selected; residual risk can only be measured after controls have been put in place. ### The order 1. Identify data assets: establish what information exists, where it is stored, and who is responsible for it. 2. Identify threats: determine who or what could cause harm. 3. Identify vulnerabilities: locate weaknesses a threat could exploit. 4. Measure initial risk: assess the potential risk before new controls are applied. 5. Implement cybersecurity controls: reduce the chance or impact of harm. 6. Measure residual risk: reassess what risk remains after the controls. ### Terms - **Residual risk**: Risk remaining after controls are applied. - **Control**: A technical or administrative measure used to reduce risk. ### Remember Assess the risk before and after controls, not just after.