Which option is NOT a step in the seven-step IDRMP process?

• A. Disaster Recovery
• B. Criticality assessment CA
• C. Threat assessment TA
• D. Risk tolerance decision

Answer: (A)

Understanding risk management in the IDRMP framework means focusing on how threats affect critical assets, and how much risk the organization is willing to accept. Threat assessment and criticality assessment are core parts of that process: they help identify potential dangers and how essential different assets are to operations. The risk tolerance decision then sets the level of residual risk the organization is prepared to accept before implementing controls. Disaster Recovery, however, belongs to continuity and response planning—it's about restoring operations after a disruption, which is not listed as one of the steps in the IDRMP risk management sequence. It may be informed by IDRMP findings, but it isn’t itself a step in the seven-step process.