Which of the following is an element included in a standard cybersecurity risk assessment? (Select all that apply)

### Why this is right - **Assets** are included because an assessment identifies what needs protection. - **Threats** are included because the assessment considers potential causes of harm. - **Vulnerabilities** are included because weaknesses can expose assets to threats. - **Risks** are included because the assessment evaluates potential harm. - **Controls** are included because the assessment recommends measures to address concerns. ### The concept These elements form a connected way to reason about security. A threat may exploit a vulnerability, creating risk to an asset. A control is selected to reduce that risk. A control may reduce risk without eliminating it, so the organization still needs monitoring and review. ### The other options - **F. A guarantee of zero incidents**: an assessment cannot guarantee this; it informs risk decisions and control recommendations. ### Terms - **Asset**: something valuable that requires protection. - **Threat**: a possible source of harm. - **Vulnerability**: a weakness that could be exploited. - **Risk**: potential harm to the organization. - **Control**: a measure used to address risk. ### Remember Use the chain asset, threat, vulnerability, risk, control to organize assessment reasoning.