A missing/ineffective security control is identified. Which of the following should be the NEXT step?

The identification of a missing or ineffective control represents the discovery of a vulnerability. According to standard risk management frameworks, the immediate next step is to understand the significance of this vulnerability. This is achieved by performing a risk assessment, which involves identifying the threats that could exploit the vulnerability and analyzing the potential likelihood and impact. The result of this assessment quantifies the risk, which is essential for making an informed decision on how to treat it (e.g., mitigate, accept, transfer, or avoid).

A. An audit may have identified the issue. The next step is to assess the risk it creates, not to re-audit the already-identified gap.
B. Escalation should occur after the risk has been assessed, so the severity and potential business impact can be clearly communicated to management.
D. Key Risk Indicators (KRIs) are metrics used for ongoing monitoring of the risk environment, not the immediate action taken after discovering a single control failure.

1. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30, Rev. 1). Figure 1 'Risk Assessment Process', p. 8. The process clearly shows that after vulnerabilities are identified, the next steps are determining likelihood and impact to calculate risk.

2. ISO/IEC 27005:2018, Information technology — Security techniques — Information security risk management. Clause 8.3 'Risk analysis'. This section specifies that after risk identification (which includes finding control gaps), the next step is risk analysis to determine the level of risk.

3. MIT OpenCourseWare. (2016). 16.888 / ESD.77J Multidisciplinary System Design Optimization. Lecture 18, 'Risk and Uncertainty'. The lecture outlines the risk management process where identification of a hazard (control gap) is followed by risk analysis/assessment.