A company discovers that several business units opened cloud accounts with corporate credit cards and are running production workloads that IT and security never reviewed. The CISO wants to begin a cloud risk assessment. What should be done first?
Select an answer to reveal the explanation.
Short Explanation
You can't protect what you don't know you've got. Shadow IT means your asset list is wrong, so step one is finding every account, using expense reports, network traffic and CASB discovery, before you start scoring risks. Jumping to controls or ratings on a partial list is the trap.
Full Explanation
Risk assessment begins with identification, and identification depends on knowing which assets exist. When business units buy cloud services outside IT, the organization's inventory is incomplete, so any analysis built on it would omit precisely the unmanaged workloads most likely to carry high risk. Discovery draws on several sources: corporate card and expense records, procurement data, network and DNS logs, CASB shadow IT discovery, and outreach to business units, followed by recording owners, data types and business purpose for each account. Applying an encryption standard to known workloads is a treatment step that skips identification and analysis, and it still leaves the unknown accounts untouched. Asking providers to suspend unapproved accounts could disrupt production services the business relies on, and it is a remediation decision that should follow assessment and stakeholder engagement, not precede it. Rating only the known workloads produces a risk register that understates exposure and gives leadership false confidence. Exam caveat: on manager-level questions, discovery and scoping come before analysis, and analysis comes before treatment. Operational check: reconcile the discovered account list against finance records to confirm every paying cloud account has a named owner and appears in the inventory.