400
The process to inventory existing security measures designed to protect assets. The measures may include policies and procedures, physical security equipment, security personnel, or some combination of these measures.
What is the second step of the risk assessment process?