In a basic risk assessment, which element indicates the effectiveness of safeguards that are already in place?

• A. Budget, personnel availability, and time to implement.
• B. Threat likelihood.
• C. Existing controls or mitigations.
• D. Impact/severity.

Answer: (C)

The main idea is to assess how well protections that are already in place are performing. The element that shows this is the existing controls or mitigations. These are the safeguards you currently have, and evaluating them means looking at how effectively they reduce risk—either by lowering the likelihood of a threat, reducing potential impact, or both. If the existing controls are strong and properly implemented, the residual risk—the risk remaining after safeguards—is low, indicating effective safeguards. If residual risk is high, that suggests gaps or weaknesses in the current controls.

The other elements don’t directly measure how well protections are working. Resources like budget, personnel, and time affect your ability to implement safeguards. Threat likelihood addresses how probable a threat is, not how effective your safeguards are. Impact or severity describes potential consequences, not the performance of safeguards.