Domain 2 Risk Management includes which components?

• A. Asset identification, threat assessment, risk appetite, third-party risk, and monitoring
• B. Board oversight, strategy alignment, roles, policies, resources, and regulatory oversight
• C. Provide independent assessment, validate controls, identify blind spots, and ensure accountability
• D. Not a penetration testing team, security operations, compliance checkbox service, or breach guarantee

Answer: (A)

Risk management in this domain centers on understanding what needs protection, the threats to those assets, how much risk the organization is willing to accept, how external partners influence risk, and ongoing oversight. Asset identification ensures you know what assets exist and their value. Threat assessment evaluates potential events that could harm those assets and helps prioritize where controls are needed. Risk appetite defines how much risk is tolerable, guiding decisions on controls and responses. Third-party risk addresses vendors and partners whose activities can affect risk. Monitoring provides continuous visibility into risk so changes in the threat landscape or asset configuration are detected and acted on promptly. The other options describe governance, assurance, or unrelated functions rather than these concrete risk management components.