RA Step 1 Task 4 requires that each information source be described with which four elements?

• A. Descriptions, threat, vulnerability, impact
• B. Threat, vulnerability, controls, mitigations
• C. Information sources, risk models, outputs, reports
• D. People, processes, technology, facilities

Answer: (A)

Describing an information source in RA Step 1 Task 4 involves four aspects: a clear description of the source, the threats it faces, the vulnerabilities it has, and the potential impact if those vulnerabilities are exploited. This combination ensures you have a precise, consistent picture of each source and how it could contribute to risk. The description tells you what the source is; threats identify possible adverse events or actors; vulnerabilities highlight weaknesses that could be exploited; and impact estimates the consequences if exploitation occurs. Together, they form the basis for evaluating risk tied to that source and for comparing multiple sources on a common footing. The other options mix elements that relate to risk controls, process artifacts, or asset categories rather than the descriptive attributes of a source.