Select ALL factors or activities that belong in the described cyber risk assessment process.

### Why this is right - **Identify data assets and their owners.**: The assessment begins by determining what information matters and who is responsible for it. - **Identify threats and vulnerabilities.**: These establish how harm could occur. - **Rate initial risk and apply controls.**: The process rates risk, selects controls, and then reassesses remaining risk. ### The concept A documented sequence makes risk decisions traceable. It links assets to possible harmful events and weaknesses, considers likelihood and impact, and records what controls are used. Controls can lower risk, but their presence does not prove that all exposure has been removed. ### The other options - **Assume controls eliminate all risk without reassessment.**: This skips the required evaluation of residual risk and treats controls as guaranteed solutions. ### Terms - **Residual risk**: Risk remaining after controls are applied. ### Remember Assessment is a cycle of identifying, rating, treating, and reassessing risk.