A geopolitical conflict has sharply increased state-sponsored cyberattacks against companies in the organization's country and sector. The related scenarios in the risk register carry likelihood ratings assessed eighteen months ago. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
A risk register is a living map, not a photo from last year's vacation. When the threat environment shifts, you update the likelihood and tell the people who own those risks so they can decide what to do. The trap is waiting for the calendar, or fiddling with the wrong number.
Full Explanation
Risk ratings are only useful if they reflect current conditions. A sharp increase in state-sponsored activity against the organization's country and sector raises the likelihood of the related scenarios, so the security manager should update those ratings with the new intelligence and communicate the change to the risk owners. They can then decide whether existing treatment remains adequate or whether additional controls, monitoring or acceptance decisions are required. Keeping outdated ratings for comparability misrepresents the current exposure and leaves owners deciding on stale information; comparability is never a reason to report a known-wrong picture. Raising impact instead of likelihood distorts the analysis, because the consequences of an attack have not changed, only its probability; risk assessment has no rule restricting likelihood updates to an annual cycle. Disconnecting regional operations is a drastic business decision that the security manager cannot make alone and that has not been justified by any assessment. Exam caveat: impact could also change if, for example, a sanctions regime altered legal consequences, but that must be shown, not assumed. Operational check: confirm the updated entries carry a new assessment date, a rationale referencing the intelligence, and an acknowledgment from each risk owner.