Arrange these governance activities in a sensible cycle for managing a newly identified cyber risk: assess the risk, establish or adjust measures, monitor results, and improve the approach based on review.

### Why this is right The organization first needs to understand the risk before choosing measures. It can then monitor whether its response is working and use review findings to improve the approach. ### The order 1. **Assess the risk**: Determine what concern needs to be addressed before selecting a response. 2. **Establish or adjust measures**: Put appropriate policies, processes, or technical measures in place. 3. **Monitor results**: Check how the measures perform in organizational operations. 4. **Improve the approach based on review**: Use what monitoring reveals to revise practices. ### Terms - **Risk assessment**: An evaluation of cybersecurity risks that can inform organizational decisions. ### Remember Governance cycles from understanding risk to acting, reviewing, and improving.