Which term describes the process of deep analysis of the state of the business and threats faced by the organization?

• A. Risk assessment
• B. Incident response
• C. Strategic planning
• D. Compliance

Answer: (C)

The process described is risk assessment. It focuses on understanding the current state of the business and identifying the threats the organization faces, along with the assets at risk, potential vulnerabilities, and the likelihood and impact of those threats. This analysis helps prioritize which risks to treat and informs the selection of appropriate controls to reduce risk to an acceptable level.

Strategic planning, by contrast, is about setting long-term goals, defining direction, and deciding how to allocate resources to achieve those goals. It isn’t primarily about analyzing threats or the current risk posture. Incident response deals with how to detect, contain, eradicate, and recover from security incidents when they occur. Compliance revolves around aligning with laws, regulations, and internal policies.