GREATEST Concerns for an Emergency Change in IT System

B.

The situation described in the question involves an emergency change made to an IT system following a failure. Emergency changes are those changes that are made to an IT system outside of the regular change management process due to the need to resolve a critical issue or incident.

Of the options given, the one that should be of greatest concern to the organization's information security manager is likely option B: "The change did not include a proper assessment of risk."

This is because an emergency change made without proper assessment of risk can introduce new vulnerabilities and expose the organization to potential security breaches. A proper assessment of risk would involve identifying potential impacts of the change, evaluating the likelihood of those impacts occurring, and determining the appropriate controls needed to mitigate those impacts.

Option A, "The operations team implemented the change without regression testing," could also be a concern as it means the change may not have been fully tested before deployment, potentially leading to unforeseen issues. However, this would likely be a secondary concern to the risk assessment issue mentioned above.

Option C, "Documentation of the change was made after implementation," is less critical as documentation can be created after a change has been implemented. However, timely and accurate documentation is still important for audit and compliance purposes.

Option D, "The information security manager did not review the change prior to implementation," is also a concern as the information security manager should have been involved in the change management process to ensure that security requirements were considered. However, this would also be a secondary concern to the risk assessment issue mentioned above.

In summary, of the options given, the organization's information security manager should be most concerned about the emergency change not including a proper assessment of risk as this can introduce new vulnerabilities and potential security breaches.