RA Step 2 Task 3 focuses on identifying what domains?

• A. Organization, mission/business processes, information system
• B. Threat sources, threat events, impacts
• C. External stakeholders, regulatory requirements, budgets
• D. User training, access control, encryption

Answer: (A)

Defining the scope of a risk assessment involves identifying the domains that need to be considered across the enterprise. The domains are the organization as a whole, the mission or business processes it performs, and the information system that supports those processes. This structure ensures you assess risk at multiple levels—from strategic and organizational objectives down to the specific IT assets and data that enable critical functions. With this framing, risks to operations, assets, and personnel can be identified and analyzed in the proper context.

The other options describe elements of risk content or controls rather than the domain boundaries for scope. Threat sources, threat events, and impacts pertain to what you’re evaluating within the scope. External stakeholders, regulatory requirements, and budgets relate to external context rather than the internal domain boundaries. User training, access control, and encryption are controls and safeguards, not the domains you map to define the assessment scope.