What is the purpose of a security survey or enterprise risk assessment?

• A. To document policy statements
• B. To train staff in emergency drills
• C. To identify vulnerabilities and threats across the organization and prioritize protections for assets
• D. To increase stock prices

Answer: (C)

The main idea here is to identify what could go wrong and where the organization is most at risk, so resources can be focused where they will reduce the most risk. A security survey or enterprise risk assessment systematically looks at all assets, the threats they face, and the vulnerabilities that could be exploited. It then evaluates how likely each risk is and what impact it would have, allowing you to prioritize protections and controls for the highest-risk assets. This approach guides where to invest, how to design the security program, and what to address first in remediation plans.

Policies and training are important activities, but they serve different purposes. Documenting policy statements is about governance and rules, not about discovering risks. Training staff for emergencies prepares people to respond, not about identifying vulnerabilities. Increasing stock prices is not related to assessing security risk.