Which of the following is MOST helpful in providing a high-level overview of current IT risk severity*?

Risk mitigation plans detail specific actions to reduce risk but do not provide a consolidated, high-level overview of the *current overall* risk severity.

A heat map visually represents risks by plotting their likelihood against their impact, often using color-coding to clearly indicate risk severity (e.g., low, medium, high) across the organization. This graphical format offers an intuitive, high-level overview that is easily digestible for various stakeholders, including senior management.

A risk appetite statement defines the acceptable level of risk but does not depict the *current* actual severity of identified risks across the organization.

Key Risk Indicators (KRIs) provide early warnings for specific risks but are individual metrics and do not inherently offer a consolidated, high-level overview of *overall* risk severity like a heat map does.