Which statement accurately describes Domain 2 Risk Management?

• A. It includes asset identification, threat assessment, risk appetite, third-party risk, and monitoring
• B. It focuses on regulatory oversight
• C. It is identical to Domain 1 Governance
• D. It handles breach guarantees

Answer: (A)

Domain 2 Risk Management centers on the ongoing process of identifying what needs protection, understanding the threats and vulnerabilities, setting the organization’s risk appetite, addressing risks from third parties, and continuously monitoring risk. The statement is the best fit because it directly lists these components—asset identification, threat assessment, risk appetite, third-party risk, and monitoring—which together define how risk is identified, evaluated, and managed across the organization. Regulatory oversight relates to compliance with external rules and is not the core of risk management. Domain 1 Governance covers setting strategy and policies rather than the day-to-day risk management processes. Breach guarantees are not a standard risk management activity; they pertain to contractual protections or incident response considerations rather than ongoing risk management.