What is a risk assessment summary?

• A. Requires knowledge of both inside systems and outside environment threats; conducted continuously; covered in all parts of the development life cycle.
• B. Is conducted only once at project initiation.
• C. Focuses solely on financial risk.
• D. Excludes environment threats.

Answer: (A)

A risk assessment summary is a comprehensive, ongoing consolidation of risks to a system, combining threats from inside the system and the external environment, evaluating likelihood and impact, and outlining prioritized mitigations across the development life cycle. It is not a one-off task; it evolves as threats, assets, and controls change, and it informs decision-making and resource allocation throughout design, implementation, and operation. Including both internal and external threats ensures no blind spots, and continuous assessment keeps the risk posture current. If a risk assessment summary were limited to a single initiation moment, focused only on financial risk, or excluded environmental threats, it would miss the full security risk picture. Therefore the described approach—addressing internal and external threats, ongoing, and spanning all phases of the life cycle—best matches a risk assessment summary.