After a ransomware note hits a city permitting system, several managers insist the event is 'PR risk only' and should skip technical risk registers. What primary risk type should drive the response?
Select an answer to reveal the explanation.
Short Explanation
Ransomware is not a press-release problem first—it's a locked filing cabinet for digital records. Call it technology and information risk so backups, isolation, and recovery get funded. PR still matters, but it shouldn't own the primary type.
Full Explanation
Ransomware primarily impairs systems and information confidentiality, integrity, and availability, so the primary classification is technology/information risk. That typing directs containment, forensics, restoration, and access controls. Reputation impacts are secondary consequences and should not replace the operational risk type that drives technical response.