The three most common categories of risk in organizational security are:

Personnel: Risks to human safety and behavior.

Property: Risks to physical and digital assets.

Liability: Legal exposure due to negligence or failure to act.

This classification helps align mitigation strategies and insurance planning.

A and D incorrectly list “hazards” as a category rather than a risk source.

B omits personnel, a critical category.