Match each risk assessment element to its corresponding definition: Elements: 1. Asset 2. Threat 3. Vulnerability 4. Risk 5. Recommended control Definitions: A. Something of value to an organization that requires protection B. A potential cause of an unwanted incident or source of harm C. A weakness or flaw that can be exploited D. The likelihood and impact of harm occurring E. A proposed safeguard or countermeasure to address a security concern

### Why this is right The matches distinguish the roles of the five elements in the assessment definition. Assets are what may need protection, threats may cause harm, vulnerabilities are weaknesses, risks concern the possibility of harm, and controls are proposed measures. ### The concept These terms are related, so it helps to keep their functions separate. A threat is not the same as a vulnerability: one is a possible source of harm, the other is a weakness. Risk is not simply another word for either one; it describes the possibility of harm in the situation. A control is a measure considered in response to security concerns, while an asset is what the organization values. ### The pairs | Item | Matches | Why | |---|---|---| | Asset | Something of value to the organization that may need protection | Assessment identifies what matters and could be affected. | | Threat | A potential source of harm | A threat is a possible cause of an adverse event. | | Vulnerability | A weakness that may be exploited or contribute to harm | A weakness can make harmful outcomes more likely. | | Risk | The possibility of harm | Risk describes potential harm in the circumstances being assessed. | | Recommended control | A measure proposed to address a security concern | A control is a possible response, not the same thing as identifying a weakness. | ### Terms - **Assessment element**: A component considered as part of the structured evaluation. ### Remember A threat may cause harm, a vulnerability is a weakness, and risk is the possibility of harm.