Risk management is described as the process of

• A. Identifying risks and reducing them
• B. Creating security policies
• C. Training staff
• D. Reducing budget

Answer: (A)

Risk management centers on identifying potential threats and taking steps to reduce their likelihood or impact. It begins with spotting risks, then assessing how likely they are and how severe their consequences could be. Based on that assessment, you prioritize which risks to address and implement controls or countermeasures to lower the overall risk, followed by ongoing monitoring and adjustment as conditions change. This description—identifying risks and taking action to reduce them—best captures the full process. Creating security policies is important groundwork but falls under governance and planning; training staff is a useful control, not the entire lifecycle; reducing the budget doesn’t address risk.