RA Step 1 Task 5 requires identifying what?

• A. Risk models and analytic approach
• B. Threat events
• C. Information sources
• D. Stakeholder approvals

Answer: (A)

The key idea here is setting up how you will measure and evaluate risk. Before you identify specific threats or collect data, you need to decide the framework you’ll use to quantify risk—this means choosing the risk models and the analytic approach that will drive the assessment. By identifying the models (for example, a qualitative scale, a quantitative probability/impact method, or more advanced techniques like Monte Carlo simulations or Bayesian networks) and the way you’ll analyze results (how likelihood and impact are combined, how uncertainty is handled, how results are aggregated across assets), you establish the blueprint for the entire risk assessment.

This matters because the chosen models and approach determine what data you’ll need, how you’ll interpret findings, and how you’ll compare risk across systems or controls. Once the methodology is set, you can proceed to characterizing threats and vulnerabilities within that framework, gathering relevant information sources, and obtaining stakeholder buy-in. The other options—threat events, information sources, or stakeholder approvals—fit later steps in the process and are not the focus of identifying the analytic approach and models.