Exam CISM topic 1 question 17 discussion

Threat and vulnerability assessments provide essential information to estimate and understand the level of risk facing an organization. By identifying potential threats and vulnerabilities, organizations can assess the likelihood and potential impact of various security incidents. This risk estimation forms the basis for making informed decisions about security controls, investments, and setting control objectives. While threat and vulnerability assessments contribute to elements of the organization's security posture (option D) and may influence control objectives (option C), the primary purpose is to assess and estimate the level of risk.

When there is Primarily in the question there is a sequence of the responses.The order here goes like this BCDA.

Risk Identification is done through asset value, threat, and vulnerability.

needed to estimate risk

B. needed to estimate risk.

Threat and vulnerability assessments are important PRIMARILY because they are needed to estimate risk (Option B).