Exam OGEA-103 topic 1 question 71 discussion

https://pubs.opengroup.org/togaf-standard/integrating-risk-and-security/integrating-risk-and-security_3.html 3.1 Enterprise Risk Management The Information Technology security and information security industry has evolved over its lifetime a view of operational risk that is concerned only with threats, vulnerabilities, and loss events (negative impacts). However, as noted earlier in Section 1.2, this Guide uses the ISO 31000:2009 [6] definition of “risk”, an “uncertainty of outcomes”, and risk management is presented as striking a balance between positive and negative outcomes resulting from the realization of either opportunities or threats.