During a recent security framework review, it was discovered that the marketing department implemented a non-fungible token asset program. This was done without following established risk…

Reporting the infraction is important for governance but should follow understanding the actual risk posed by the new program.

The first step when an unauthorized system or process is implemented without following established risk procedures is to perform a risk assessment to understand the new program's potential impact, vulnerabilities, and threats. This assessment identifies the associated risks, allowing for informed decisions on mitigation strategies, rather than immediately discontinuing it or only reporting the infraction.

Conducting risk awareness training is a preventative measure for future incidents, not an immediate response to an already implemented unauthorized program.

Discontinuing the process immediately might be disruptive and premature without a full understanding of the risks, dependencies, or potential business value, even if it was implemented improperly.