Which of the following provides a structured approach to addressing information system change risks?

The correct answer is “Security-focused Configuration Management” because it specifically involves the systematic management of an information system’s configurations to maintain security and integrity while addressing any changes. This approach provides a framework for assessing, implementing, and monitoring changes in the configuration of hardware and software components, ensuring that any modifications do not introduce new vulnerabilities or affect the security posture of the information system.

Security-focused Configuration Management helps mitigate risks by establishing baseline configurations and applying security controls throughout the lifecycle of the information system. It allows for careful tracking of changes and ensures that any modifications are made in a controlled manner, thereby reducing the probability of introducing security flaws.

While other options like Security Incident Management, Risk Assessment, and Standard Operating Procedures are certainly important in the overall security framework, they do not provide the same structured focus on managing change risks specifically related to system configurations as Security-focused Configuration Management does. Security Incident Management deals primarily with responding to actual security breaches, while Risk Assessment is more about identifying and evaluating risks rather than managing changes. Standard Operating Procedures can guide processes but do not specifically address the nuances of configuration management in the same way.