The greatest risk is unintentional human error, such as misaddressing an email. Security awareness training equips users to recognize PII and verify recipients. MFA protects account access but not outbound emails.
IDS detects network threats, not email content. Audit trails only provide after-the-fact evidence.
References (ISACA): COBIT DSS05 (security awareness and user controls).

Ransomwareis a type of malicious software that encrypts the victim's data and demands a ransom for its decryption1. Ransomware attacks can cause significant damage to an organization's operations, reputation, andfinances1. Therefore, it is important to mitigate the impact of ransomware attacks by implementing effective prevention and recovery strategies.
One of the best ways to mitigate the impact of ransomware attacks is to back up data frequently12345. Data backups are copies of the organization's data that are stored in a separate location or medium, such as an external harddrive, cloud storage, or tape2. Data backupscan help the organization restore its data in case of a ransomware attack, without paying the ransom or losing valuable information2. Data backups shouldbe performed regularly, preferably daily or weekly, depending on the criticality and volume of the data2. Data backups should also be tested periodically to ensure their integrity and usability2.
The other options are not as effective as backing up data frequently in mitigating the impact of ransomware attacks. Invoking the disaster recovery plan (DRP) is a reactive measure that can help the organization resume its operations after a ransomware attack, but it does not prevent or reduce the damage caused by the attack3.
Paying the ransom is not a recommended option, as it does not guarantee the decryption of the data or the deletion of the stolen data by the attackers. Paying the ransom also encourages further attacks and funds criminal activities14. Requiring password changes for administrative accounts is a good security practice, but it is not sufficient to prevent or recover from ransomware attacks. Ransomware attacks can exploit other vulnerabilities, such as phishing emails, outdated software, or weak network security15.
References: 1: How to Mitigatethe Risk of Ransomware Attacks: The Definitive Guide 2: Mitigating malwareand ransomware attacks - The National Cyber Security Centre 3: 3 steps to prevent and recover from ransomware 4: Ransomware Epidemic: Use these 8 Strategies to Mitigate Risk 5: Practical Steps to Mitigate Ransomware Attacks - ITSecurityWire

One of the challenges in developing a SLA for network services is finding performance metrics that can be measured properly and reflect the quality of service expected by the customer. Establishing a well-designed framework for network services is not a challenge, but a good practice. Ensuring that network components are not modified by the client or reducing the number of entry points into the network are security issues, not SLA issues. References: ISACA, CISA Review Manual, 27th Edition, 2018, page 333

Stress testing is a type of performance testing that evaluates how a system behaves under extreme load conditions, such as high user traffic, large data volumes, or limited resources. It is useful for identifying potential bottlenecks, errors, or failures that may affect the system's functionality or availability. Stress testing during the quality assurance (QA) phase would have identified the concern of users complaining that a newly released ERP system is functioning too slowly. The other options are not as relevant for this concern, as they relate to different aspects of testing, such as regression testing (verifying that existing functionality is not affected by new changes), interface testing (verifying that the system interacts correctly with other systems or components), or integration testing (verifying that the system works as a whole after combining different modules or units). References: CISA Review Manual (Digital Version), Domain 5: Protection of Information Assets, Section 5.4 Testing Techniques1