Explanation/Reference:
Explanation:
A layered defense strategy would only prevent those activities that are outside of the user's privileges. A signed acceptable use policy is often an effective deterrent against malicious activities because of the potential for termination of employment and/or legal actions being taken against the individual. System audit log monitoring is after the fact and may not be effective. High-availability systems have high costs and are not always feasible for all devices and components or systems.

A risk assessment identifies the organization's specific threats, vulnerabilities, and business impacts, which most effectively determines what security policies are needed to manage risk in line with business objectives and risk tolerance.

= Reevaluation of risk is a vital aspect of the risk management process that helps organizations to identify and analyze new or evolving threats, vulnerabilities, and impacts on their assets, and implement the necessary controls to mitigate them. Reevaluation of risk is most critical when there is a change in the threat landscape, which refers to the external and internal factors that influence the likelihood and severity of potential attacks on the organization's information assets. A change in the threat landscape may be caused by various factors, such as technological innovations, geopolitical events, cybercrime trends, regulatory changes, or organizational changes. A change in the threat landscape may introduce new risks or alter the existing risk profile of the organization, requiring a reassessment of the risk appetite, tolerance, and strategy. Reevaluation of risk helps the organization to adapt to the changing threat landscape and ensure that the information security program remains effective, efficient, and aligned with the business objectives.
Reference =
CISM Review Manual 15th Edition, page 1131
CISM Domain 2: Information Risk Management (IRM) [2022 update]2
Reevaluation of Risk | CISM Exam Question Answer | ISACA3

The correct answer is C because emerging risk should be addressed as early as possible in the system development life cycle, beginning with the planning phase. During planning, the organization defines business objectives, scope, requirements, stakeholders, expected benefits, technology approach, and initial risk considerations. Addressing risk early allows security requirements, compliance obligations, privacy needs, architecture expectations, and control considerations to be included before major design and implementation decisions are made. If risk is first addressed during design, implementation, or testing, the organization may face higher remediation costs, delays, or architectural limitations. Testing can identify whether controls are working, but it is too late to be the first point for addressing emerging risk. CISM emphasizes integrating security and risk management into business processes and system life cycle activities from the beginning.
Early risk identification supports better decision-making, cost-effective control design, and alignment with business objectives. Therefore, the first phase should be planning.
Reference: CISM Information Risk Management; system development life cycle, early risk identification, security requirements, and risk-based planning principles.