Which area is listed as an area covered when updating the risk assessment?

• A. Organization operations and assets, individuals, other orgs, the nation.
• B. Only IT assets.
• C. Only customer data.
• D. Marketing and branding.

Answer: (A)

When updating a risk assessment, you examine the broad range of areas that can be affected by risk across the entire organization, not just technology or data. The best choice reflects this wide scope: it includes organization operations and assets, individuals, other organizations, and the nation. This aligns with established risk assessment guidance that considers internal operations, people, external partners, and broader national or cross-border factors that could impact security and continuity.

Why the other options don’t fit: focusing only on IT assets misses the human and external-entity aspects that can drive risk; limiting to customer data ignores broader assets and stakeholders; and marketing and branding cover a narrow business function that doesn’t address the full spectrum of risks to operations, assets, people, and external relations.