What is risk management in C2 and how is it applied?

• A. Identifying, assessing, and mitigating risks to protect personnel, information, and operations; applied via controls, plans, and continuous monitoring.
• B. Focusing only on financial risk to the operation.
• C. Avoiding any actions that could be risky at all times.
• D. Delaying risk assessment until after operations.

Answer: (C)

Risk management in C2 is about systematically handling what could go wrong so operations stay safe and effective. It starts with identifying potential threats and vulnerabilities that could affect personnel, information, or the operation. Then you assess how likely those risks are and how severe their impact would be. Based on that assessment, you choose and implement mitigations—such as technical controls, procedures, training, and contingency plans—to reduce the risk to an acceptable level. Continuous monitoring and periodic reassessment keep the risk picture up to date, so you can adjust defenses as the situation changes.

This approach makes sense because you’re not trying to eliminate all risk (which is often impossible); instead you balance mission goals with acceptable risk and preparedness. The other ideas—focusing only on financial risk, avoiding any risky action at all times, or delaying risk assessment until after operations—don’t capture the ongoing, broader, and proactive nature of effective risk management in C2.