Question

A KRI monitoring failed privileged-access login attempts has just crossed its established threshold for the third consecutive week. The metric is owned by the IT security manager, and reporting is automated and accurate. What should the risk practitioner ensure happens FIRST in response to this sustained breach?

Accepted Answer

The predefined escalation and response actions tied to the KRI threshold are triggered and executed

Answer

The KRI threshold is recalibrated upward so the metric stops generating breach alerts

Answer

A new compensating control is designed and deployed to reduce failed login attempts

Answer

The breach is documented in the next quarterly risk report for stakeholder awareness