The core issue is a failure in resource allocation driven by conflicting priorities, where critical security monitoring was neglected for other "competing business demands." The primary function of an IT steering committee is to provide strategic direction and ensure IT activities align with enterprise objectives, which includes managing risk. Re-prioritizing IT projects and tasks is the most direct and immediate strategic action the committee can take to address this misalignment. This ensures that critical security functions are given the appropriate level of importance and resources, directly mitigating the identified risk without immediately resorting to tactical solutions like hiring or process updates.

B. Updating the RACI chart is a tactical step to clarify roles. The problem was not undefined responsibility, but the inability of responsible staff to perform their duties due to higher-priority tasks.
C. Hiring additional staff is a potential long-term solution that requires justification and budget. It is not the first priority, as the immediate issue is one of prioritization, not necessarily a permanent lack of capacity.
D. An assessment of resource capacity is a valuable input for the re-prioritization process, but it is not the action itself. The committee's first directive should be to re-prioritize based on the new risk information.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: IT Resource Optimization

Task 4.2

"Direct the prioritization of IT initiatives and services based on enterprise requirements and objectives." The scenario presents a clear failure in prioritization that has led to a security breach

making re-prioritization a direct responsibility of the governance body (steering committee).

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Governance Objective EDM03 (Ensured Risk Optimisation)

Key Activities. The board and executive management (often delegated to a steering committee) are responsible for directing the setting of priorities for risk management actions. The uncovered breaches represent an unacceptable level of risk

requiring immediate direction and re-prioritization.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO05 (Managed Portfolio)

Practice APO05.03

"Manage the portfolio of services." This practice includes evaluating

prioritizing

and balancing programs and services. The failure to review logs indicates a breakdown in this process

which the IT steering committee must direct IT management to correct.