The CIO of an enterprise learns the payroll server of a competitor has been the victim of ransomware. To help plan for the possibility of ransomed corporate data, what should be the ClO's FIRST…

Requiring development of Key Risk Indicators (KRIs) is a step for ongoing monitoring, not the immediate first response to a specific, emerging threat identified by an incident.

Developing a policy to address ransomware is an important mitigation strategy, but it should be informed by the findings and specific risks identified in a targeted risk assessment.

A targeted risk assessment is the most effective first step because it specifically investigates the enterprise's unique vulnerabilities, exposure, and potential impact related to ransomware on critical corporate data, similar to the competitor's incident. This assessment provides a clear understanding of the threat landscape and informs the most appropriate and effective mitigation strategies before implementation.

Backing up corporate data is a critical preventative control, but as the 'first course of action' for a CIO, a risk assessment determines if the *current* backup strategy is sufficient or needs immediate enhancement for this specific threat.