A key risk indicator tracking critical systems with overdue patches has exceeded its approved threshold for the second consecutive month. The risk management procedure defines an escalation path for each threshold level. What should the information security manager do FIRST?

Thresholds on key risk indicators exist so that decisions about escalation are made before pressure arises. When an indicator exceeds its approved threshold, the information security manager follows the defined procedure and escalates to the designated risk owner, who has the authority to decide on treatment, resources and priorities. Two consecutive breaches strengthen the case for prompt escalation rather than weakening it. Raising the threshold to match current performance redefines acceptable risk without the authority to do so and hides the deterioration the indicator was designed to expose; any change to a threshold must go through risk governance. Ordering an emergency patching window may ultimately be part of the response, but doing it first and without the owners skips the decision process, risks disrupting critical business services and leaves accountability unclear. Waiting for a third month delays a response the procedure already requires and extends exposure while adding no meaningful information. Exam caveat: the manager may recommend a treatment when escalating, but the owner decides. Operational check: confirm the escalation was made through the defined channel, that the owner's decision and target date are recorded, and that the indicator is tracked until it returns within threshold.