An organization has experienced several incidents of extended network outages that have exceeded tolerance. Which of the following should be the risk practitioner's FIRST step to address this…

Recommending additional controls without understanding the root cause may lead to ineffective, misdirected, or unnecessary mitigations.

Updating the risk tolerance level to acceptable thresholds without addressing the underlying problem is a reactive measure that bypasses actual risk management and is irresponsible.

Updating the incident-related risk trend in the risk register is a documentation task and does not proactively address or resolve the core issue of the incidents.

Repeated network outages exceeding tolerance suggest a systemic or underlying problem that needs to be addressed comprehensively, not just symptoms. Recommending a root cause analysis (RCA) is the most appropriate first step as it systematically investigates the fundamental causes of the incidents, enabling the organization to implement effective and sustainable preventative measures rather than superficial fixes.