How is risk assessment typically conducted over time?

• A. Continuously on an ongoing basis.
• B. Only after security incidents occur.
• C. Only during audits.
• D. Only at the end of the project.

Answer: (A)

Risk assessment is most effective when treated as an ongoing, continuous process throughout the system’s life cycle. As assets, threats, and vulnerabilities change, a continual evaluation keeps the risk picture current, helps re-prioritize mitigations, and informs timely decisions and control adjustments. This approach supports adaptive security and aligns with continuous monitoring, ensuring protections stay appropriate as conditions evolve. Doing risk assessment only after incidents, only during audits, or only at the end of a project leaves risks unaddressed for too long and can result in controls that no longer fit the actual environment.