An information security manager wants to improve the ability to identify changes in risk levels affecting the organization's systems. Which of the following is...