A. can occur without risk treatment, process of selection. or implementation of measures to modify risk.
B. involves the process of identifying internal and external threats and vulnerabilities.
C. generally includes coordinated activities to direct and control an organization in regard to risk.
D. defines the controls in place necessary to reduce exposure and evaluate the cost of such controls.