1.9 Understand and apply risk management concepts

• 1.9.1 Threat and Vulnerability Identification
• 1.9.2 Risk Analysis, assessment, and scope
• 1.9.3 Risk response and treatment
• 1.9.4 Applicable Types of Controls
• 1.9.5 Control Assessments
• 1.9.6 Continuous monitoring and measurement
• 1.9.7 Reporting (e.g., Internal, External)
• 1.9.8 Continuous improvement (e.g., risk maturity modeling)
• 1.9.9 Risk Frameworks