Section: Volume D

* A change management process is a set of procedures and activities that ensure that any changes to the IT systems or applications are planned, approved, tested, implemented, and documented in a consistent and controlled manner.
* A change management process has recently been updated with new testing procedures. This means that the process has been improved or modified to include new or additional steps or methods for verifying and validating the changes before they are deployed to the production environment.
* The next course of action after updating the change management process with new testing procedures is to communicate to those who test and promote changes. This means that the change management team or function should inform and educate the people who are involved or affected by the changes, such as the developers, testers, users, customers, etc., about the new testing procedures, their purpose, benefits, requirements, and expectations.
* Communicating to those who test and promote changes helps to ensure that the new testing procedures are understood and followed by all the parties, that the changes are tested and promoted in accordance with the process standards and criteria, and that the changes are delivered with the expected quality and performance.
* The other options are not the next courses of action after updating the change management process with new testing procedures. They are either secondary or not essential for change management.
The references for this answer are:
* Risk IT Framework, page 27
* Information Technology & Security, page 21
* Risk Scenarios Starter Pack, page 19

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster1. The first task when developing a BCP should be to identify critical business functions and resources, because this will help to determine the scope, objectives, and priorities of the plan. Critical business functions and resources are those that are essential for the continuity of the company's operations, and that would cause significant disruption or damage if they were interrupted or lost. By identifying critical business functions and resources, the company can focus its efforts and resources on protecting and restoring them, and minimizing the impact of a disaster. The other options are not the first task when developing a BCP, because they depend on the identification of critical business functions and resources, as explained below:
* A. Determine data backup and recovery availability at an alternate site is a task that relates to the recovery strategy of the BCP, which aims to restore the data and information systems that support the critical business functions and resources. However, this task cannot be performed without first identifying which data and information systems are critical, and what level of availability and recovery they require.
* C. Define roles and responsibilities for implementation is a task that relates to the organization and governance of the BCP, which aims to assign and communicate the duties and expectations of the personnel involved in the plan. However, this task cannot be performed without first identifying which personnel are critical, and what functions and resources they are responsible for.
* D. Identify recovery time objectives (RTOs) for critical business applications is a task that relates to the analysis and evaluation of the BCP, which aims to measure the acceptable downtime and recovery speed of the critical business functions and resources. However, this task cannot be performed without first identifying which business applications are critical, and what impact and likelihood they have.
References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page
115. What Is a Business Continuity Plan (BCP), and How Does It Work?, Business continuity plan (BCP) in 8 steps, with templates | BDC.ca, How Develop a Business Continuity Plan - Invenio IT, Business Continuity Planning | Ready.gov, Develop a Robust Business Continuity Plan | Wrike

Providing assurance on risk management processes is the activity that should only be performed by the third line of defense, because it is the role and responsibility of the independent and objective assurance function, such as internal audit or external audit, to evaluate and report on the effectiveness and efficiency of the risk management processes and controls. The third line of defense is the last layer of the three lines of defense model, which is a framework that defines the roles and responsibilities of different functions and levels within the organization for risk management and control. The first line of defense is the operational management and staff, who are responsible for identifying, assessing, and managing the risks and controls within their areas of responsibility. The second line of defense is the oversight and support functions, such as risk management, compliance, or legal, who are responsible for establishing and monitoring the risk policies, standards, and frameworks, and providing guidance and advice to the first line of defense. The third line of defense is the assurance function, who are responsible for providing independent and objective assurance on the adequacy and effectiveness of the risk management processes and controls, and reporting to the senior management and the board of directors. Operating controls for risk mitigation, testing the effectiveness and efficiency of internal controls, and recommending risk treatment options are all activities that can be performed by the first or second line of defense, but not by the third line of defense, as they are not part of the assurance function.
References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.4.1, page 59

The best recommendation to address recent IT risk trends that indicate social engineering attempts are increasing in the organization is to conduct a simulated phishing attack, as it tests the awareness and behavior of the employees in responding to a realistic and targeted email scam, and identifies the areas and individuals that need improvement or training. Updating spam filters, revising the acceptable use policy, and strengthening disciplinary procedures are not the best recommendations, as they may not address the human factor of the risk, or may be too reactive or punitive, respectively. References = CRISC Review Manual, 7th Edition, page
155.