Which statement is true about RAM assessment context options?

Which statement is true about RAM assessment context options?

• A. Risk Statement is the only option
• B. Application Risk is the only option
• C. Risk is a valid option and Object is also a valid option
• D. Project Risk is the only option

Answer: (C)

The idea being tested is that RAM assessments can be scoped to different targets, giving you flexibility in how risk is evaluated. In RAM, you can set the assessment context to either a Risk record or an Object, so both are valid options. This means you’re not tied to a single target—the assessment can focus on the risk itself or on the object (such as an asset or item you’re evaluating) that carries risk. Choosing the Risk context makes the results feed directly into that risk record, supporting tracking of treatments, residual risk, and controls tied to that specific risk. Choosing the Object context evaluates the risk posture of the object and how various risks relate to it, supporting asset-centric risk governance. The statements that restrict the RAM assessment context to only one option don’t reflect this dual capability, which is why the correct idea is that both Risk and Object are valid contexts.

The idea being tested is that RAM assessments can be scoped to different targets, giving you flexibility in how risk is evaluated. In RAM, you can set the assessment context to either a Risk record or an Object, so both are valid options. This means you’re not tied to a single target—the assessment can focus on the risk itself or on the object (such as an asset or item you’re evaluating) that carries risk.

Choosing the Risk context makes the results feed directly into that risk record, supporting tracking of treatments, residual risk, and controls tied to that specific risk. Choosing the Object context evaluates the risk posture of the object and how various risks relate to it, supporting asset-centric risk governance. The statements that restrict the RAM assessment context to only one option don’t reflect this dual capability, which is why the correct idea is that both Risk and Object are valid contexts.