Which elements are essential in a physical security risk assessment?

• A. Employee training; budget planning; marketing; public relations
• B. Threat assessment; Asset valuation; Vulnerability assessment; and Risk evaluation
• C. Asset valuation; threat assessment; vulnerability assessment; risk determination; and control prioritization
• D. Patrol schedules; alarm response times; crisis communications; vendor management

Answer: (C)

A physical security risk assessment is structured around identifying what needs protection, evaluating threats and vulnerabilities, determining risk, and prioritizing controls. Asset valuation establishes what deserves protection and how crucial it is, guiding the level of security applied. Threat assessment identifies potential sources of danger and how likely they are to occur. Vulnerability assessment reveals weaknesses in existing defenses that could be exploited. Risk determination combines the asset value, threat likelihood, and vulnerability strength to gauge overall risk. Finally, control prioritization decides which security measures to implement first based on the level of risk, ensuring resources are used where they’ll reduce the most risk.

Other options include elements that belong to broader security programs or incident response rather than the assessment process itself. For example, training, budgeting, marketing, and public relations are supportive or organizational activities, not the step-by-step framework of an assessment. Likewise, patrol schedules, alarm response times, crisis communications, and vendor management focus on operations and management after risks are identified, not on the assessment steps themselves.