In cybersecurity risk assessment, the process typically involves both identifying organizational assets and recommending controls to mitigate identified risks.

### Why this is right Both assets and recommended controls appear directly in the course definition. The assessment examines these alongside threats, vulnerabilities, and risks. ### The concept An **asset** is something an organization values and may need to protect. A **control** is a measure recommended to address a security concern. Identifying assets helps clarify what could be harmed, while recommending controls connects assessment findings to possible action. The course uses the word “recommended,” which matters: assessment results can guide decisions, but the definition does not say that every recommendation is automatically implemented. ### The other options - **False**: This would be incorrect because assets and recommended controls are explicitly included in the definition. ### Terms - **Asset**: Something of value to an organization that may need protection. - **Control**: A measure recommended or used to address a security concern. ### Remember Assets and recommended controls are both named elements of the assessment definition.