An information security manager is evaluating the key risk indicators (KRIs) for an organization's information security program. Which of the following would be the information security manager's GREATEST concern?

A legacy application does not comply with new regulatory requirements to encrypt sensitive data at rest, and remediating this issue would require significant investment. What should the information security manager do FIRST?

Risk identification, analysis, and mitigation activities can BEST be integrated into business life cycle processes by linking them to:

Which of the following is the BEST reason to reassess risk following an incident?

Which of the following would be of GREATEST concern to an information security manager when evaluating a cloud service provider (CSP)?