Watch this video on YouTube
A security control assessor notices that an information system's security controls have not been updated to address a newly discovered threat. What should the assessor do next?