The correct answer is C because the first step when assessing newly installed IT systems is to inventory the IT systems . Before the systems can be reviewed for configuration, classified, or added to the risk register, the organization must first identify what systems exist in the environment and bring them into scope for assessment.
The other options come later:
* A. Review asset configuration requires the systems to have already been identified.
* B. Update the risk register occurs after risks have been identified and assessed.
* D. Classify the IT systems also depends on first knowing what systems exist.
Exact Extracts supporting the answer:
* "The FIRST step in identifying and assessing IT risk is to gather information on the current and future environment."
* "The PRIMARY reason for determining the security boundary prior to conducting a risk assessment is to identify the scope of the risk assessment."
* "Understanding the system and its subsystems is the MOST effective method to conduct a risk assessment on an internal system in an enterprise."
* "The preparation of a risk register begins in the risk identification process." These extracts support that risk assessment starts with identifying the environment and scope. Therefore, the first action is to inventory the IT systems .