RA Step 2 Task 2 focuses on identifying what?

• A. Potential threat events
• B. Vulnerabilities and predisposing conditions
• C. Information sources
• D. Controls

Answer: (A)

This focuses on identifying potential threat events—the specific occurrences or actions that could exploit a vulnerability and affect information, systems, or operations. By naming these events, you lay the groundwork for assessing how likely each threat is and what impact it could have, which drives risk prioritization and mitigation planning. Threat events can be intentional (like a cyberattack or insider misuse), unintentional (human error), or natural (flood, power outage). This is distinct from identifying vulnerabilities (weaknesses that could be exploited), information sources (where threat data comes from), or controls (safeguards you implement). While all of these elements are important, the task in this step is to pinpoint what could happen, not the weaknesses or remedies themselves.