A possible action that a risk practitioner should do next when an increased industry trend of external cyber attacks is identified is A. Conduct a threat and vulnerability analysis. A threat and vulnerability analysis is a process of identifying and assessing the potential sources and methodsof cyber attacks, as well as the weaknesses and gaps in the organization’s information systems and security controls12 By conducting a threat and vulnerability analysis, a risk practitioner can determine the level of exposure and risk that the organization faces from external cyber attacks, and prioritize the actions and resources needed to mitigate or prevent them3 A threat and vulnerability analysis can also help to update the risk impact rating and the key risk indicator in the risk register, as well as to notify senior management of the new risk scenario, but these are subsequent steps that follow after the analysis is completed. Therefore, the first action that a risk practitioner should do next is to conduct a threat and vulnerability analysis.