Security Risk Assessments Responses

Provide (2) 150 words substantive response with a minimum of 1 APA references for RESPONSES 1 AND 2 below. Response provided should further discuss the subject or provide more insight. To further understand the response, below is the discussion post that’s discusses the responses. 100% original work and not plagiarized. Must meet deadline.
RESPONSE 1:
What is a Security Risk Assessment?

A security risk assessment identifies, assesses, and implements security controls within company assets (data, hardware, software, etc.). Threats and vulnerabilities are the main fucus of that risk and the assessment helps to minimize the risk by implementing controls.
What elements does it entail?

There are five elements that include risk analysis, identifying risks to manage, selecting controls, implementing and testing controls, and evaluating the controls.
Does it include or exclude Penetration Testing?

Penetration testing is a type of security risk assessment. This type of testing attempts to evaluate the security of an IT infrastructure by attempting to exploit vulnerabilities in a safe way.
What types of Security Risk Assessments exists? Identify at least 3.

Facility physical vulnerability, information systems vulnerability, and proprietary information risk.
-ROSE
RESPONSE 2:
1. Security Risk Assessments happen on multiple levels. First, identify the IT assets and their significance to an organization, then distinguish the threats and vulnerabilities to the assets and prioritize them. Next, recognizing the probability that one of these vulnerabilities will be abused will ultimately identify the consequence of the risk. Finally, whichever risk is highest should be fixed first. 
2. The elements entailed in a Security Risk Assessment are assessing the risks, identifying risks to manage, selecting controls, implementing and testing the controls, and evaluating controls.  
3. Security Risk Assessments do include Penetration Testing. These tests are used for external networks, Websites, and Web applications and also for internal networks. 
4. Three types of Security Risk Assessments are insider threats posed by people inside the organization, information systems vulnerabilities that can be introduced via malware, backdoor programs, or phishing attacks, and proprietary information risk, which are trade secrets of an organization that could be detrimental if leaked. Joshua