Which of the following provides the MOST comprehensive insight into ongoing threats facing an organization?

The risk register is the most comprehensive tool for providing insight into ongoing threats. It serves as a central, dynamic repository for all identified risks, which are composed of threats, vulnerabilities, and impacts. Unlike other options that represent point-in-time assessments, the risk register is a living document. It is continuously updated through ongoing risk monitoring and assessment activities, providing a holistic and current view of the organization's risk posture and the evolving threat landscape. This makes it the primary tool for managing and understanding the full spectrum of threats over time.

A. A business impact analysis (BIA) primarily identifies the operational and financial impacts of a disruption to critical business functions, not the threats themselves.

C. Penetration testing is a specific, time-bound activity designed to actively exploit a subset of vulnerabilities, not a comprehensive overview of all ongoing threats.

D. A vulnerability assessment identifies and quantifies security weaknesses in systems but does not, by itself, provide a comprehensive view of the threats that might exploit them.

---

1. ISACA. (2022). CISM Review Manual

16th Edition. Chapter 2: Information Risk Management

p. 99. The manual states

"The risk register is a tool that is used to collect and maintain information about all the risks identified by the organization." It details that the register includes threat sources

vulnerabilities

and other elements

serving as the central repository for ongoing risk management.

2. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-39

Managing Information Security Risk. Section 2.3

"Risk Management Process

" and Figure 2-2. This publication outlines the risk management process

where risk monitoring is a continuous step. The outputs of monitoring (e.g.

new threats) are used to update risk assessments and

consequently

the risk register

highlighting its role in tracking ongoing risk.

3. Peltier

T. R. (2010). Information Security Risk Analysis

Third Edition. Auerbach Publications. Chapter 5

"Risk Assessment Methodologies

" p. 103. This academic text describes the risk register as the "repository for all identified risks" and the "primary input to the risk mitigation process

" emphasizing its central and comprehensive role in tracking threats and their associated risk components. (DOI not applicable for the entire book

but it is a peer-reviewed academic publication in the domain).