Which approach best describes cyber risk assessment?

• A. Rely solely on a single vendor's controls
• B. Delay cyber risk assessment until after a breach
• C. Identify critical assets, threats, vulnerabilities; evaluate likelihood and impact; implement layered cybersecurity controls; monitor KRIs
• D. Assume cyber risk is negligible with basic antivirus

Answer: (C)

A solid cyber risk assessment is a structured, proactive process that starts with identifying what matters most to protect—critical assets, data, and systems. From there, you map out potential threats and vulnerabilities that could affect those assets, then estimate how likely each threat is and how severe the impact would be if it materializes. This creates a clear risk picture that guides where to focus defenses.

Implementing layered cybersecurity controls, or defense in depth, is essential because it reduces reliance on any single safeguard. If one control fails, others still stand guard, and protection spans people, processes, and technology. Ongoing monitoring through key risk indicators keeps the risk posture current, signaling when controls need adjustment or when new threats appear. This continuous view lets you prioritize resources, measure improvements, and adapt to changes in the environment.

This approach is the best because it moves beyond guesswork and reactive steps. It builds a prioritized, measurable plan, supports ongoing improvement, and acknowledges that risk is dynamic. In contrast, relying on a single vendor’s controls leaves gaps, waiting to assess risk until after a breach misses prevention opportunities, and assuming risk is negligible with basic antivirus vastly underestimates the breadth and sophistication of modern threats.