Which term refers to a process that includes a set of activities working toward a goal in security management?

• A. Risk Assessment/Risk Analysis (RA)
• B. Internal Environment
• C. Process
• D. Vendor Viability

Answer: (C)

In security management, a process is a defined sequence of activities designed to achieve a specific objective. It’s the umbrella term for how work is done, with clear steps, responsibilities, inputs, outputs, and controls so the work can be repeated and measured. This fits the description of “a set of activities working toward a goal” best.

The best answer is a process because risk assessment or risk analysis refers to a particular activity within risk management, not the general framework of how work is organized. The internal environment describes the organizational context in which risk management operates, not the mechanism of carrying out a goal. Vendor viability concerns the capability of a supplier, not the method by which security work is performed.