When preventive controls to appropriately mitigate risk are not feasible, which of the following is the MOST important action for the information security manag...