A risk practitioner learns that the organization s industry is experiencing a trend of rising security incidents. Which of the following is the BEST…

A risk practitioner should evaluate the relevance of the evolving threats to the organization’s

industry, as this is the best course of action to understand the current and future risk landscape, and

to align the risk management strategy accordingly. By evaluating the relevance of the evolving

threats, the risk practitioner can determine the impact and likelihood of the threats affecting the

organization’s objectives, assets, and processes, and prioritize the most critical and urgent risks. The

risk practitioner can also identify the gaps and weaknesses in the existing controls, and recommend

appropriate risk response measures to mitigate the threats. The other options are not as good as

evaluating the relevance of the evolving threats, because they do not address the root cause of the

rising security incidents, but rather focus on the symptoms or consequences of the

incidents. Reference = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1,

page 85.