What is the basic DHS risk management process and its key steps?

• A. Plan, Do, Check, Act.
• B. Risk assessment, mitigation planning, and performance monitoring (context and risk assessment, risk treatment/mitigation, and monitoring/reassessment).
• C. Context and risk assessment, risk treatment/mitigation, and monitoring/reassessment.
• D. Identify, Analyze, Resolve.

Answer: (C)

The basic DHS risk management process centers on three connected activities: first, set the context and perform a risk assessment to understand what needs protection, what could threaten it, and how those threats could materialize; second, carry out risk treatment or mitigation to reduce what’s left to an acceptable level; and third, continuously monitor and reassess to ensure controls stay effective and adapt to changes. This sequence—context and risk assessment, risk treatment/mitigation, and monitoring/reassessment—captures how DHS approaches risk because it starts with understanding the environment and risks, then acts to reduce them, and keeps checking back to adjust as events evolve.

Why this ordering fits best: starting with context ensures you know what matters and why before weighing threats and vulnerabilities. Moving to risk treatment/mitigation gives concrete actions to lower risk to acceptable levels. Ongoing monitoring and reassessment ensures risk management remains current as conditions, threats, and capabilities change.

The other options miss one or more essential pieces. A quarterly or generic Plan-Do-Check-Act cycle isn’t tailored to the specific risk-based approach DHS uses. A version that calls out mitigation planning and performance monitoring is close but still emphasizes different framing and doesn’t explicitly start with setting context and a formal risk assessment. A sequence like Identify, Analyze, Resolve omits explicit ongoing monitoring and reassessment and the broader context-setting step.