A risk practitioner discovers that an IT operations team manager bypassed web filtering controls by using a mobile device, in violation of the network security policy. Which of the following should…

Bypassing web filtering controls in violation of policy constitutes a security incident, as it could expose the organization to threats and indicates a breakdown in control enforcement. The risk practitioner's first responsibility is to report this incident through the established incident management process to ensure it is properly investigated and handled.

Planning a security awareness session is a proactive measure for future prevention but does not address the immediate policy violation and potential security breach.

While assessing the potential new risk is important, it occurs after the incident has been reported and an initial investigation has identified the scope and nature of the bypass.

Updating the risk register is a later step, possibly reflecting the control failure or new risk, but the immediate priority is to address the active policy violation as an incident.