An organization's board of directors is concerned about recent data breaches in the news and wants to assess its exposure to similar scenarios. Which of the following is the BEST course of action?

The board's concern stems from external data breaches, implying a need to understand the organization's own resilience. Evaluating existing data protection controls directly assesses how well the organization is currently protected against such breaches by reviewing the design and operational effectiveness of its security measures. This will provide a direct answer to their concern about exposure.

While risk appetite and tolerance are important for setting overall risk strategy, reassessing them doesn't directly evaluate the current effectiveness of defenses against data breaches.

Evaluating data sensitivity is a critical component of data classification and risk assessment, but it doesn't directly assess the effectiveness of controls against breaches, which is the immediate concern triggered by external events.

Reviewing data retention policies and regulatory requirements is important for compliance, but it focuses on data lifecycle and legal obligations rather than the immediate effectiveness of technical and administrative controls to prevent a breach.