DAL is used to prioritize assets for defense based on which factors?

• A. Criticality, Vulnerability, Recouperability, and Threat
• B. Criticality and Vulnerability only
• C. Threat and Recouperability only
• D. All of the above

Answer: (A)

The main idea is that protecting assets is a risk-based judgment across four dimensions. An asset’s protection priority rises with how critical it is to operations, how vulnerable it is to attack or failure, how hard it would be to recover if it were disrupted, and how credible and capable the threats against it are. Criticality focuses on the importance and impact—the more essential the asset, the higher the priority. Vulnerability looks at weaknesses that an adversary could exploit, so more vulnerable assets need stronger defenses. Recoverability assesses resilience—the ability to restore the asset quickly after disruption; assets with poor recoverability create longer downtimes and greater overall impact, increasing their defense priority. Threat accounts for the likelihood and potential severity of adversarial actions against the asset.

Using all four factors together gives a complete picture of risk and helps allocate defense resources where they’ll have the greatest effect. If you consider only some factors, you might underprotect a highly critical asset that’s vulnerable and hard to recover, or overprotect something with low threat. That’s why the comprehensive four-factor approach is the best fit.