Arrange these actions in a sensible sequence for using a risk-based approach to plan security measures.

### Why this is right A risk-based approach begins by identifying what the organization needs to protect. It then considers threats to those assets, uses the assessment to select priorities, and directs resources accordingly. ### The concept Risk-based security helps organizations avoid treating every system or threat as equally important. Asset criticality gives context to possible harm, while threat likelihood helps inform where action is most appropriate. The sequence is a planning aid, not a claim that risk assessment is performed only once; organizations should revisit priorities as conditions change. ### The order 1. **Identify important organizational assets.** You need to know what requires protection before assessing threats to it. 2. **Consider the likelihood of threats affecting those assets.** This connects possible threats to the assets identified. 3. **Select and prioritize measures in light of the assessed risks.** The assessment informs which measures deserve attention. 4. **Use the resulting priorities to guide security resource allocation.** Resources can then be directed toward the selected priorities. ### Terms - **Asset**: Something of value to an organization that may need protection. - **Risk-based security**: Security planning that uses risk information to set priorities. ### Remember Identify what matters, assess threats to it, then prioritize controls and resources.