Which of the following BEST enables an organization to address new risk associated with an Internet of Things (IoT) solution?

Transferring risk (e.g., via insurance) is a risk treatment option, but it doesn't address the technical risks or vulnerabilities of the IoT solution itself.

Integrating security controls and procedures early in the IoT solution's lifecycle (e.g., during design and development) ensures that security is 'built-in' rather than 'bolted-on.' This approach is more cost-effective, reduces vulnerabilities from the start, and makes the system inherently more resilient to the unique and diverse risks associated with IoT.

Updating risk tolerance simply accepts a higher level of risk; it does not address or mitigate the new risks associated with the IoT solution.

Implementing IoT device monitoring software is a control, but it's reactive or post-deployment. Building controls in early is a more comprehensive and proactive approach to addressing new risks.