An organization becomes aware that IT security failed to detect a coordinated cyber attack on its data center. Which of the following is the BEST course of action?

Performing a business impact analysis (BIA) assesses the impact of disruptions but does not address why the attack went undetected or how to fix the security gap.

Identifying compensating controls may be a part of the solution, but without understanding the root cause of the initial failure, the compensating controls might not address the core issue.

A failure to detect a coordinated cyber attack indicates a significant gap or deficiency in security controls, processes, or technologies. Conducting a root cause analysis is essential to thoroughly investigate the underlying reasons for this failure, identify systemic weaknesses, and implement effective, targeted remediation to prevent future occurrences.

Revising key risk indicator (KRI) thresholds might be a consequence of the analysis, but it doesn't explain or fix the failure in detection itself.