Which of the following would MOST likely require a risk practitioner to update the risk register?

An alert from a security operations center (SOC) typically indicates a potential incident or anomalous activity, which might trigger an investigation, but it doesn't automatically require an update to the *risk register* itself unless it reveals a previously unknown risk or a significant change in an existing one.

The development of a project schedule for a risk response is a planning activity; the actual *implementation* (completion) is what changes the risk posture and requires the register update.

The completion of a project that implements a new control directly changes the organization's risk posture by mitigating an existing risk or addressing a vulnerability. This significant event necessitates an update to the risk register to reflect the implemented control, reassess the residual risk, and potentially change the status of the associated risk from "open" or "in progress" to "mitigated" or "monitored."

Engaging a third party for a vulnerability scan is an assessment activity designed to *identify* vulnerabilities, which may *lead* to identifying new risks or updating existing ones, but the *engagement itself* doesn't directly alter the risk posture. The *findings* of the scan, once analyzed, might lead to an update.