Senior management is concerned about an increase in cybersecurity risk to the enterprise. Which of the following would be MOST helpful in establishing an early warning system to determine which potential threats should be escalated to senior management?

A. Agreed-upon risk thresholds
B. A risk appetite statement
C. Key performance indicators (KPIs)
D. Patch management logs