Which of the following should be a risk practitioner's NEXT action after identifying a high probability of data loss in a system?

A. Conduct a control assessment.
B. Purchase cyber insurance from a third party.
C. Increase the frequency of incident reporting.
D. Enhance the security awareness program.