A series of cyber events impacting internet-facing business services has been successfully contained. To minimize future business risk exposure, which of the following should the board require of…

Reviewing the ISP contract might be part of an overall security review but is unlikely to uncover the fundamental technical or process issues that led to the cyber events.

Purchasing cybersecurity insurance is a risk mitigation strategy to transfer financial risk, but it does not prevent future cyber events or address the underlying vulnerabilities.

A business impact analysis (BIA) assesses the potential effects of an interruption to critical business functions and helps prioritize recovery efforts, but it does not identify the causes of past incidents or prevent future ones.

A root cause analysis (RCA) systematically investigates the underlying reasons for an incident, identifying not just the symptoms but the fundamental flaws or weaknesses that led to the cyber events, which is crucial for implementing effective preventative measures and minimizing future risk exposure.