Risk assessment should consider existing controls before deciding whether additional safeguards are needed.

### Why this is right Existing controls affect the risk that remains. Evaluating them helps an organization decide whether current protections are sufficient or whether more safeguards are needed. ### The concept Assessment is not simply a list of threats. It considers vulnerabilities, likelihood, impact, and current protections. Treatment decisions should reflect the remaining risk after existing controls are taken into account. ### Terms - **Control**: a safeguard used to reduce risk or protect information and systems. ### Remember Check current protections before deciding what additional safeguards to add.