In risk assessment planning, which element is considered primary?

• A. Missions/business functions
• B. Networks
• C. Physical security
• D. Incident response

Answer: (A)

Risk assessment planning starts with understanding what the organization must accomplish—the missions and business functions that are essential to its operations. This focus identifies which processes, data, and systems are critical and therefore where risk management efforts should be concentrated. When you know which missions are non‑negotiable and which functions support them, you can prioritize threats, vulnerabilities, and controls to protect those priorities and ensure operation continuity.

Other domains like networks, physical security, and incident response matter, but they are evaluated through the lens of supporting the mission and critical functions. For example, protecting payroll processing or patient records is prioritized because those functions are mission-critical; how networks are segmented or how physical access is controlled is considered in terms of how well they safeguard those key operations.