Which is a major phase of a DSAC Annex F risk management process?

• A. Threat modeling
• B. Disaster recovery planning
• C. Asset inventory
• D. Determine scope and context

Answer: (D)

Setting the scope and context is the major phase because it establishes what needs protection, why it matters, and how risk will be evaluated. By defining the boundaries, stakeholders, objectives, and risk criteria up front, you set a clear focus for everything that follows—which assets are in play, what regulatory or contractual obligations apply, and what level of risk is acceptable. This foundation ensures that later steps are coherent and directed at the right targets. Threat modeling is a technique used within the assessment to explore how threats could affect the defined assets, asset inventory is the listing of what you’re protecting, and disaster recovery planning deals with restoring operations after an incident. But none of those can be effectively done without first clarifying scope and context.