Senior management wants to increase investment in the organization's cybersecurity program in response to changes in the external threat landscape. Which of the following would BEST help to…

Cyber intelligence reports provide external threat data but don't directly prioritize internal investment needs without a formal risk assessment.

Engaging independent consultants can be valuable but is a resource rather than a direct prioritization method.

Increasing the frequency of risk register updates is a good practice but doesn't, on its own, determine which investments are most critical.

Reviewing the outcome of the latest security risk assessment is the best way to prioritize investment efforts. A risk assessment identifies, analyzes, and evaluates specific threats, vulnerabilities, and their potential impacts on the organization's assets, providing a clear, prioritized list of risks that need mitigation and directly informing where investment would yield the most significant reduction in overall risk.