The concept of risk management is best described as the following:

A.
Risk management reduces risks by defi ning and controlling threats and vulnerabilities.

B.
Risk management identifies risks and calculates their impacts on the organization.

C.
Risk management determines organizational assets and their subsequent values.

D.
All of the above.

Explanation:
B: Risk management minimizes loss to information assets due to undesirable events through identifi cation, measurement, and control. It encompasses the overall security review, risk analysis, selection, and evaluation of safeguards, costbenefit analysis, management decision, safeguard identifi cation and implementation, along with ongoing eff ectiveness review. Risk management provides a mechanism to the organization to ensure that executive management knows current risks, and informed decisions can be made. Page 405.