You are the owner of a growing company, SpeeDelivery, which provides courier services. You decide that it is time to draw up a risk analysis for your information system. This includes an inventory of the threats and risks. What is the relation between a threat, risk and risk analysis?

A.
A risk analysis identifies threats from the known risks.

B.
A risk analysis is used to clarify which threats are relevant and what risks they involve.

C.
A risk analysis is used to remove the risk of a threat.

D.
Risk analyses help to find a balance between threats and risks.

Explanation:
A risk analysis has four main objectives:
1. To identify assets and their value;
2. To determine vulnerabilities and threats;
3. To determine the risk that threats will become a reality and disrupt the operational process;
4. To determine a balance between the costs of an incident and the costs of a security measure.