An organization performs its information security risk assessment annually. Four months after the last one, the core customer database is migrated to a public cloud service. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
An annual checkup doesn't mean you skip the doctor after a car crash. A major change like moving the crown-jewel database to the cloud triggers a reassessment right away. The trap is hiding behind the calendar or behind the provider's paperwork.
Full Explanation
Periodic assessments establish a baseline, but significant change is a trigger for reassessment regardless of the schedule. Moving the core customer database to a public cloud service changes the threat exposure, the control environment, the division of responsibilities and possibly the legal and regulatory position, so the previous assessment no longer describes the risk. The security manager should assess the migrated environment now, including the organization's own configuration and access responsibilities under the shared responsibility model. Waiting for the annual cycle leaves the most valuable data operating for months under an unassessed risk profile, and the provider is responsible only for its part of the stack; accountability for the data stays with the organization. A provider attestation report is useful evidence about the provider's controls, but it does not cover the customer's configuration, identity management or data protection choices and is not a risk assessment of this deployment. Updating the inventory alone records the change without evaluating what it means for risk. Exam caveat: ideally the assessment occurs before migration as part of change and project governance; if it did not, it must happen now. Operational check: confirm the change management process requires a risk assessment for significant changes and that one exists for this migration.