An organization's HRIS vendor announces it will no longer patch a legacy system that holds employee PII. What risk management step should HR take first?
-
A
Migrate all data immediately to a new system
-
B
Conduct a risk assessment to quantify exposure and prioritize remediation
-
C
Notify all employees of the potential breach
-
D
Terminate the vendor contract with cause