Which sequence correctly represents the core risk assessment steps listed in the lesson?

### Why this is right The assessment begins by identifying what is at risk, then identifies threats and weaknesses. It evaluates how likely and harmful a risk may be before prioritizing it for action. ### The concept A **risk assessment** is a structured way to understand possible harm to assets. Assets provide the targets, threats describe possible causes of harm, and vulnerabilities describe weaknesses that could be exploited. Likelihood and impact analysis helps compare risks so that attention can be directed appropriately. ### The other options - **Risk prioritization, asset identification, control installation, threat identification, vulnerability assessment**: it prioritizes before identifying what is at risk or analyzing the risks. - **Threat identification, employee training, asset identification, incident response, risk acceptance**: these are not the listed assessment sequence, and training is not a substitute for the analysis steps. - **Vulnerability assessment, insurance purchase, asset identification, impact analysis, system retirement**: this mixes possible treatment actions with assessment and begins without identifying assets. ### Terms - **Risk prioritization**: ranking risks to guide which receive attention first. ### Remember Identify the asset and risk factors before deciding which risks deserve priority.