What describes the evaluation of the type, scope and nature of events or actions that can result in adverse consequences; identification of the threats that exist against enterprise assets?

• A. Threat event
• B. Threat actor
• C. Risk awareness program
• D. Threat assessment/analysis

Answer: (D)

Threat assessment/analysis is the process of evaluating the types, scope, and nature of events or actions that could result in adverse consequences, and identifying the threats that exist against enterprise assets. This framing captures both what could happen (the events or actions) and who or what could cause harm (the threats), which informs how to protect assets and prioritize controls. A threat event is a specific incident rather than the overall evaluation. A threat actor is the attacker or source of threat, not the analysis itself. A risk awareness program focuses on educating people about risk rather than identifying and evaluating potential threats.