A business lists threats, weaknesses and likely consequences before choosing controls. What activity is this?

1. Risk assessment
2. Evidence preservation
3. Incident eradication
4. Risk transfer