[Trae Johnson]

You elaborated well on how risks relate to assets and why controls matter. I agree that the identification of threats and matching them with the right safeguards is central to strong risk assessment. Your point about combining software controls with policies and physical protection shows a good understanding of layered security.