An organization has experienced a cyber-attack that exposed customer personally identifiable information (Pll) and caused extended outages of network services. Which of the following stakeholders are

Security control owners focus on specific controls, which may be a part of the incident, but risk owners have a broader view of the business impact.

Cyber risk remediation plan owners are responsible for long-term fixes, but the immediate response requires decision-making from those accountable for the actual risks.

Risk owners are accountable for the specific risks that materialized and their associated impacts, making them crucial for determining appropriate response actions and understanding the full scope of the incident. This ensures that the individuals ultimately responsible for the business functions and assets affected are directly involved in resolution.

The ERM team provides oversight and framework but may not have the granular operational accountability needed for immediate response actions.