Which term is the strategy of forming layers of protection for an asset?

Which term is the strategy of forming layers of protection for an asset?

• A. Protection in Depth
• B. Records
• C. Preparedness
• D. Residual Risk

Answer: (A)

Forming layers of protection around an asset is defense in depth. This approach relies on multiple, overlapping safeguards—such as physical barriers, access controls, monitoring, procedures, and training—so that if one layer is bypassed or fails, others still stand to deter, detect, or slow down the threat. The idea is not to rely on a single control but to create a cascade of protections that together reduce risk to an acceptable level. By distributing protection across people, processes, and technology (and physical measures), you improve resilience and increase the chances of preventing or mitigating harm. Other terms don’t describe this strategy. Records refer to documentation about assets, not a protection system. Preparedness is about being ready to respond to incidents, not the layered protections around an asset. Residual risk means the remaining risk after controls are applied, which is the outcome you assess after implementing layers, not the strategy of layering protections.

Forming layers of protection around an asset is defense in depth. This approach relies on multiple, overlapping safeguards—such as physical barriers, access controls, monitoring, procedures, and training—so that if one layer is bypassed or fails, others still stand to deter, detect, or slow down the threat. The idea is not to rely on a single control but to create a cascade of protections that together reduce risk to an acceptable level. By distributing protection across people, processes, and technology (and physical measures), you improve resilience and increase the chances of preventing or mitigating harm.

Other terms don’t describe this strategy. Records refer to documentation about assets, not a protection system. Preparedness is about being ready to respond to incidents, not the layered protections around an asset. Residual risk means the remaining risk after controls are applied, which is the outcome you assess after implementing layers, not the strategy of layering protections.