The company has announced significant layoffs that will take place over the next six months. Morale is low, and many affected staff have privileged access to sensitive systems. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
A big internal change like layoffs shifts the odds of insider trouble, the same way a heatwave raises fire risk. So you reassess the risk for the roles involved and work with HR and the business on sensible controls. Don't fall for the extremes: cutting everyone off on day one, or doing nothing until the last day.
Full Explanation
Internal factors change risk just as external threats do. Announced layoffs raise the likelihood of insider misuse, data theft and sabotage, especially where affected staff hold privileged access. The security manager should reassess insider risk for the affected roles and work with human resources, legal and business leaders to agree proportionate controls such as tighter privilege review, enhanced monitoring of sensitive actions within legal limits, data loss prevention attention and coordinated access removal timing. Revoking access for everyone on announcement day halts work that the business still needs done over six months and may itself provoke harm. Waiting for each final day ignores the elevated risk during the notice period, which is when most damage can occur. Deploying monitoring without human resources and legal involvement can breach privacy law, employment agreements and policy, and it bypasses the governance that legitimizes such controls. Exam caveat: security advises and coordinates; human resources and business management own the employment decisions and timing. Operational check: confirm affected privileged accounts are listed, each has an agreed control and removal date with its manager, and the insider risk entry in the register was updated.