Refer to the information below to answer the question. An organization experiencing a negative financial impact is forced to reduce budgets and the number of Information Technology (IT) operations sta

Increasing third-party audits is a detective control that identifies problems after the fact but does not proactively restructure internal roles or reduce the ongoing operational risk caused by merged security and IT functions.

Removing privileged accounts from operational staff entirely could cripple IT operations, as staff still need appropriate access to perform their duties; it does not address the structural problem of unseparated roles.

Assigning privileged functions to appropriate staff is a partial measure but does not address the core issue of integrating security into distinct, separate roles with proper segregation of duties and accountability.

Separating the security function into distinct roles establishes segregation of duties, ensuring that no single reduced-staff member has unchecked control over both operational and security functions. This addresses the root problem - that security is not separate and distinct - by creating dedicated roles with defined responsibilities and oversight, which is a foundational principle of access control and risk management. Even with fewer staff, clearly delineated security roles prevent conflicts of interest and reduce the risk of unauthorized or erroneous actions.