Which type of assessment evaluates the changes in technical or operating environments that could result in adverse consequences to an enterprise?

A threat assessment is the process of identifying and evaluating potential threats, which are any events or circumstances with the potential to adversely impact enterprise operations or assets. This assessment specifically analyzes the threat environment, including changes in technology (e.g., new hacking tools), operating environments (e.g., geopolitical instability), or threat actor tactics. The goal is to understand the sources of potential harm so the enterprise can prepare its defenses accordingly.

A. A vulnerability assessment focuses on identifying internal weaknesses or flaws, not on evaluating external environmental changes or threat sources.
C. A control self-assessment is an internal review process where staff evaluate the adequacy and effectiveness of existing controls.

1. ISACA, IT Risk Fundamentals Study Guide, 2nd Edition. Chapter 2, "IT Risk Identification," distinguishes between threats (external or internal agents/events) and vulnerabilities (weaknesses). A threat assessment focuses on the former.

2. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1). Section 2.2.1, page 7. Defines threat assessment as the process of identifying and evaluating threats to an organization.

3. MIT OpenCourseWare. (2016). 16.888/ESD.77J Multidisciplinary System Design Optimization. Spring 2010. Lecture 20, "Risk and Uncertainty," outlines that threat assessment involves identifying threat sources and events.