What factors characterize a security threat in a risk assessment?

• A. Color of walls and carpet.
• B. Number of cameras only.
• C. Likelihood, potential impact, vulnerability, and existing controls; requires prioritization for mitigation.
• D. Staff preferences.

Answer: (C)

In risk assessment, a security threat is characterized by likelihood, potential impact, vulnerability, and the existing controls, with those factors guiding prioritization for mitigation. Likelihood is how probable the threat event is to occur. Potential impact is the level of harm it would cause to assets, operations, or people if it happens. Vulnerability is the weaknesses that could be exploited by the threat. Existing controls are the measures already in place to reduce risk, and they determine the residual risk after mitigation. Since resources are limited, threats are ranked to decide where to allocate effort and fixes first—typically those with high likelihood and significant potential impact, especially where vulnerabilities are exposed and controls are weak or insufficient.

Color of walls and carpet has no bearing on threat level, the number of cameras alone doesn’t define risk since it doesn’t capture likelihood or impact, and staff preferences aren’t relevant factors in threat characterization.