A company records that customer records are held in a cloud database and that the IT manager is accountable for them. Which risk documentation step is this?

### Why this is right The company is recording what data it has, where the data resides, and who is responsible for it. Those are the defining tasks of identifying data assets. ### The concept A data asset is information that has value to an organization and therefore needs protection. Recording its location helps identify relevant systems and safeguards. Recording an owner establishes accountability for decisions about the asset. This step comes before assessing threats and weaknesses because risk analysis needs to know what could be harmed. ### The other options - **B. Identify vulnerabilities**: This means locating weaknesses, such as weak passwords, rather than cataloguing information and ownership. - **C. Measure residual risk**: This evaluates risk remaining after controls have been applied. - **D. Identify threats**: This identifies possible harmful actors or events, not the data and its owner. ### Terms - **Data asset**: Information with value to an organization that requires protection. - **Cloud database**: A database hosted on cloud-based computing infrastructure. ### Remember Data, location, and accountable owner point to asset identification.