Which of the following is a common framework applied by business management and other personnel...

The correct answer is A. Risk management framework. The question describes an enterprise-level risk management approach used by management and other personnel to identify events that may affect business objectives, manage risks and opportunities, and provide reasonable assurance that objectives will be achieved. In CEH-aligned information security concepts, risk management focuses on identifying organizational assets, threats to those assets, and vulnerabilities, then selecting countermeasures to reduce risk and improve the organization’s security posture. EC-Council risk management phases include Risk Identification, Risk Assessment, Risk Treatment, Risk Tracking, and Risk Review. Qualitative risk assessment is only one method of assessing risk using descriptive ratings such as low, medium, and high; it is not the full enterprise framework. PCI-DSS applies specifically to payment card data security, and NIST SP 800-37 is a specific federal information-system risk management publication. Therefore, the best general CEH answer is Risk management framework.