An organization discovers that a system initially categorized as Moderate has begun processing information that could affect national security if breached. What action is required?
-
A
Maintain the current categorization until the next annual review
-
B
Recategorize the system upward to reflect the new information type
-
C
Document the change and notify the ISSO without formal recategorization
-
D
Apply compensating controls without changing the baseline