A risk assessment must be performed

• A. Once
• B. Annually
• C. In response to changes
• D. On a schedule determined by the provider

Answer: (C)

Risk assessment is an ongoing process that must be updated when changes occur that could affect security, privacy, or regulatory compliance. When systems, workflows, personnel, data flows, new technologies, or vendor relationships change, new vulnerabilities and exposure can emerge. Reassessing in response to these changes helps ensure that safeguards remain aligned with the current environment and threat landscape, and that any new risks are identified and mitigated promptly.

Static approaches—doing it once, or on a fixed annual schedule, or according to someone’s predefined timetable—can miss newly introduced risks. A change-driven approach keeps risk management current, and is often complemented by continuous monitoring and periodic reviews to catch evolving risks even when no major changes are immediately visible.