RA Step 4 Task 2 Update Risk Assessment specifies which areas and timing?

• A. Org operations and assets, individuals, other orgs, the nation; time-driven or event-driven updates.
• B. Only IT networks; quarterly updates.
• C. Only personnel changes; upon hiring.
• D. Only regulatory compliance; annually.

Answer: (A)

Updating a risk assessment should reflect that risk is dynamic and shaped by changes across the whole operating environment. The best fit is a broad scope that includes organizational operations and assets, individuals, other organizations, and the nation, paired with a flexible timing approach that can be time-driven on a regular cadence or event-driven in response to incidents, changes, or new information. This ensures the risk picture stays current as people, partners, assets, or external threat factors evolve, and as regulatory or national contexts shift.

Options that limit updates to IT networks, or to personnel changes only, or that restrict updates to a yearly regulatory focus, miss important sources of risk and fail to capture the full, changing landscape that can affect security posture. The comprehensive approach covers both internal operations and external factors, and it recognizes the need to update promptly when significant events occur or new threats emerge.