An information security manager learns that a departmental system is out of compliance with the information security policy’s password strength requirements. Which of the following should be the information security manager’s FIRST course of action?

A. Submit the issue to the steering committee for escalation
B. Conduct an impact analysis to quantify the associated risk
C. Isolate the non-compliant system from the rest of the network
D. Request risk acceptance from senior management