Which steps are involved in performing a risk-based planning process for a cybersecurity audit universe?

• A. Identify assets, threats, and vulnerabilities; assess inherent risk; and document the plan.
• B. Identify assets, threats, and vulnerabilities; assess inherent and residual risk; map to organizational objectives; prioritize audits by risk; and document the plan.
• C. Identify assets and compliance checklists only.
• D. Focus on IT budgets and vendor contracts.

Answer: (B)