The correct answer is C because after a post-mortem review of a new zero-day exploit, the risk team should update the risk events / risk scenarios so future assessments and monitoring reflect this newly observed threat pattern and attack path. A post-incident review should strengthen the organization's risk knowledge base and ensure similar events are represented in scenario development, assessment, and monitoring.
The other options are less appropriate as the next risk-team action:
* A. Revise the risk appetite is too high-level and would not normally change because of one exploit.
* B. File a claim against the organization ' s cyber insurance policy may be handled separately, but it is not the main risk management follow-up from the review.
* D. Notify customers affected by the attack may be necessary operationally or legally, but the question asks what the risk team should do next as a result of the post-mortem review.
Exact Extracts supporting the answer:
* "After a security incident the first step toward yielding an actionable plan that effectively mitigates the risk is root cause analysis."
* "The BEST way to verify that critical production servers are using up-to-date antivirus signature files is to Check a sample of servers."
* "The BEST way for an incident response team to identify the source of a malware attack to reduce the likelihood of recurrence is through Root cause analysis."
* "Risk scenarios enable the risk assessment process because they help estimate the frequency and impact of risk."
* "An emerging risk should be added to the risk register by the risk practitioner when the activity that triggers the risk initiates." These extracts support that once a new exploit pattern is identified, the organization should incorporate it into future risk analysis through updated risk events or scenarios.