Tier 1 risk coverage includes which core area?

• A. Governance
• B. Information and Information Flow
• C. Environment of Operation
• D. Incident Response

Answer: (A)

Tier 1 risk coverage focuses on governance. Governance establishes the policy, oversight, risk appetite, roles and responsibilities, and compliance framework that guide how risk is identified, assessed, and mitigated across the organization. This foundational layer sets the direction and authority for every other risk activity, ensuring resources, decisions, and accountability align with organizational objectives and regulatory requirements.

Information and Information Flow deals with how data is managed and moved, which is an operational concern that operates within the governance framework. Environment of Operation describes the ongoing operating context—people, processes, and technology in which risk exists—also an area that follows from governance. Incident Response covers how the organization detects and responds to security events, a capability implemented once governance and risk management structures are in place. Therefore, governance best fits Tier 1 risk coverage.