Risk assessment
A structured evaluation of what could go wrong, how likely it is, what it would cost, and what you will do about it.
It is the foundation nearly every framework requires, and it is what makes security spending defensible. Without it, control selection is guesswork dressed up as strategy.
The output that matters is decisions: what is being mitigated, what is accepted, and who accepted it. Risk acceptance is a business decision that needs a named owner rather than silent tolerance.
Where this comes up
Risk assessment sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.