A.An increase in overall security funding

B.An increase in control self-assessments (CSAs) performed

C.A decrease in residual risk

D.A decrease in the number of security incidents

A.Inform senior management.

B.Update the business impact assessment.

C.Activate the business continuity plan (BCP).

D.Categorize incidents by the value of the affected asset.

A.Alert employees to the attack.

B.Notify senior management

C.Confirm the infection.

D.Isolate the affected systems.

A.A baseline risk assessment is performed.

B.The information security manager develops the strategy

C.Compliance with regulations is demonstrated.

D.A steering committee is established

A.Information security program roadmap

B.Risk heat map

C.Business case

D.Business impact analysis (BIA)