How do IO risk management and cyber risk management relate?

• A. They share threat modeling, risk assessment, and resilience planning.
• B. IO risk management and cyber risk management operate on entirely separate threat models.
• C. IO risk management is always more important than cyber risk management.
• D. Cyber risk management concerns only hardware vulnerabilities.

Answer: (C)

Both IO risk management and cyber risk management use the same risk management toolkit to protect information and operations. They share threat modeling, risk assessment, and resilience planning because both domains assess who might attack, what they might do, and how severe the consequences could be, then put measures in place to prevent, withstand, and recover from those events.

Threat modeling helps map out potential adversaries, targets, and attack paths in the information environment and in digital systems; risk assessment weighs how likely those threats are and how bad the impact would be; resilience planning designs steps to maintain operations or quickly recover if an incident occurs. Because these steps address overlapping threats—such as a cyber intrusion affecting information integrity, or an IO operation being disrupted by a cyber event—the two risk management streams should be integrated rather than kept separate.

The other options don’t fit because they imply a disconnect or an absolute priority that doesn’t hold in practice. IO and cyber risk landscapes can influence each other, so treating them as entirely separate threat models misses how interconnected these domains are. The relative importance of IO versus cyber risk isn’t fixed; it depends on the mission and context. And cyber risk covers more than hardware vulnerabilities—it includes software, networks, firmware, supply chain, and human factors, not just hardware.