Question

A manufacturing company deploys new IT and operational technology systems on a near-monthly basis, but risk assessments are only performed during the annual enterprise risk review. As a result, several recently deployed systems introduced significant exposures that were not identified until an incident occurred. Which action would BEST address the root cause of this problem?

Accepted Answer

Embed risk assessment as a required gate within the organization's change management process

Answer

Increase the frequency of the enterprise risk review from annual to quarterly

Answer

Purchase cyber insurance to cover losses from newly introduced system exposures

Answer

Add more key risk indicators (KRIs) to the risk monitoring dashboard