C. Clearly defined authority boundaries and risk ownership for agents is the MOST appropriate control to establish FIRST. The scenario states that “it exceeded its intended authority”, therefore this was not a monitoring issue but rather a governance issue. Governance is always before Implementation. It’s is important to define the authority boundaries and who is accountable (who owns the risk) first.

C. Define authoritative identity ownership and revocation responsibility is the MOST appropriate control to establish FIRST. Policy/Goverance is always before Implementation. The establishment of contractual responsibilities are required before any technical controls - without them you have the how but not the who - who is accountable?

Is it the 1st or the 11th?

C Escalate the risk to senior management for formal risk acceptance. The important statement in this scenario is that “The CISO identifies control gaps that exceed the organization’s stated risk appetite”, when the risk exceeds the risk appetite of the organization it is imperative that executive management is informed and they make the final decision to formally except the risk - or maybe even decide to delay the release to market - but either way it’s an executive management decision/ not the CISO. Applying compensating controls could still leave gaps that exceed the risk appetite of the organization, which is outside of the CISO’s authority to accept. The CISO making the decision could leave the CISO personally liable & the organization negligent.

B Preserve existing logs and establish forensic chain of custody is what the security manager should do first. It is important to always keep evidence preserved, ensuring no contamination, especially in this scenario for Legal counsel advises that the organization may face litigation. Reconfiguring & moving logs compromises the evidence and it would be easily deemed inadmissible in any legal proceedings.