Which statement best represents the outcome of Task P-2 Risk Management Strategy?

• A. Ongoing assessments are scheduled and tracked.
• B. A formal authorization package is prepared and reviewed.
• C. A risk management strategy for the organization that includes a determination and expression of organizational risk tolerance is established.
• D. The organization adopts a specific cybersecurity framework profile.

Answer: (C)

The key idea here is establishing how the organization will manage risk at a broad, strategic level. Task P-2 Outcomes are about creating a documented risk management strategy that defines how risk will be handled across the organization, including the determination and expression of organizational risk tolerance. This sets the thresholds for risk acceptance and provides the governance framework, guiding decisions on controls, resources, and responsibilities throughout RMF activities.

Ongoing assessments and tracking belong to ongoing monitoring activities, not the initial risk strategy. Preparing and reviewing a formal authorization package relates to authorization decisions, not the risk strategy. Adopting a specific cybersecurity framework profile is about choosing a framework approach, which can be part of how controls are implemented but doesn’t by itself establish the risk tolerance and governance framework described in the risk management strategy.