Threat intelligence reports that a ransomware group has begun targeting organizations in the company's industry sector, using techniques not considered in the last annual risk assessment. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
When the weather forecast changes, you don't wait for next year's almanac and you don't buy a new roof on a hunch. You check whether your current defenses hold up against this specific storm. The trap is jumping to a purchase, insurance or tool, before you know where the gap is.
Full Explanation
A material change in the external threat landscape is a trigger for risk reassessment, not something to park until the next cycle. The security manager should update the affected scenarios with the group's known techniques, evaluate whether existing preventive, detective and recovery controls such as backups, segmentation and privileged access management address them, and adjust likelihood and residual risk accordingly. The result tells management whether additional treatment is needed and where. Buying insurance first commits to a transfer option without knowing the residual risk, and insurance does not reduce the likelihood of an attack or the operational disruption. Waiting for the annual assessment leaves management working from an outdated picture during the period of highest exposure. Deploying another endpoint product is a technical solution chosen before the gap is identified; the weakness may lie in recovery, identity or segmentation instead. Exam caveat: urgent tactical steps such as confirming backup integrity can run alongside the reassessment, but the reassessment drives the decisions. Operational check: confirm the risk register entries for ransomware were updated with a new assessment date and that any new treatment actions have owners and due dates.