What must a risk assessment identify to be compliant?

• A. Only threats
• B. Only vulnerabilities
• C. Critical assets, threats, and vulnerabilities
• D. Compliance gaps

Answer: (C)

In a risk assessment, you map three things together: what you’re protecting (the critical assets), the threats that could harm those assets, and the vulnerabilities that could be exploited. Identifying critical assets tells you what has the most impact if breached. Knowing the threats helps you understand what events could cause harm. Pinpointing vulnerabilities reveals where weaknesses lie that an attacker could exploit. Together, these elements let you assess risk and prioritize controls and remediation.

If you only list threats, you lack the asset and vulnerability context needed to gauge actual risk. If you only list vulnerabilities, you don’t show what adverse events could exploit them. And while identifying compliance gaps can be part of assessments, it doesn’t on its own define risk to assets—risk assessment centers on understanding how assets, threats, and vulnerabilities interact to drive potential harm.