ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The activity focuses on judging the likelihood that each identified vulnerability will be exploited and estimating the potential impact on the organization. This quantitative or qualitative appraisal is the essence of risk analysis. Risk identification precedes this step and simply catalogs potential threats; risk treatment (or mitigation planning) follows analysis and selects controls to reduce risk; monitoring is performed after controls are in place to verify effectiveness. Therefore, the described work maps to the risk analysis phase.