Question

An information security manager established a key risk indicator (KRI) that tracks the percentage of privileged accounts without multifactor authentication. The KRI was set with a threshold of 5%. Over the last three monthly reporting cycles the value has climbed from 4% to 6% to 9%, breaching the threshold. What is the security manager's BEST first action?

Accepted Answer

Escalate the trend to the accountable risk owner so a risk response decision can be made

Answer

Lower the KRI threshold to 10% so the metric no longer shows a breach

Answer

Immediately disable all privileged accounts that lack multifactor authentication

Answer

Remove the KRI from the risk dashboard because it is generating too many alerts