Threat assessment is defined as:

• A. Formal description and evaluation of threat to an information system.
• B. The formal description and evaluation of risk to an information system.
• C. A vulnerability scan and assessment.
• D. An incident response plan.

Answer: (A)

Threat assessment involves identifying and evaluating threats to an information system, including who or what could threaten it, their capabilities, the likelihood of an attack, and the potential impact. The option that best matches this is the formal description and evaluation of threat to an information system. This focuses on what threats exist and how serious they could be, which is different from assessing overall risk (which combines threats with vulnerabilities and other factors), scanning for vulnerabilities (weakness identification), or planning how to respond after an incident.