An organization has concerns regarding a potential advanced persistent threat (APT). To ensure that the risk associated with this threat is appropriately managed, what should be the organization's FIRST action?

A. Report to senior management.
B. Initiate incident response processes.
C. Implement additional controls.
D. Conduct an impact analysis.