A team lists 'ransomware' without identifying affected processes or outcomes. What is the best next step?

1. Develop a specific scenario with assets, attack conditions, and business consequences
2. Purchase a generic control before defining the exposure
3. Assign an exact annual loss without further inputs
4. Treat every department's exposure as identical