Risk ranking is defined as a defined criterion of measurement based upon the risk assessment and risk analysis performed on a given entity.

• A. A schedule for routine penetration testing.
• B. A defined criterion of measurement based upon the risk assessment and risk analysis performed on a given entity.
• C. A predefined criterion of measurement based upon the risk assessment and risk analysis performed on a given entity.
• D. A matrix of control owners and responsibilities.

Answer: (B)

Risk ranking is about turning risk results into a measured order that guides where to focus controls and mitigations. The best option defines a criterion of measurement that is grounded in the risk assessment and risk analysis performed on a specific entity. This means the ranking is tailored to the entity’s actual threats, vulnerabilities, and impact, making it meaningful for prioritization. It’s not about a schedule for testing or a simple ownership map, which address different aspects of security program governance. Also, risk ranking should be defined from the entity’s assessment rather than relying on a fixed, one-size-fits-all standard, since the point is to reflect the unique risk posture of the environment.