Your security manager revises the risk register on Monday. Two days later, a developer modifies a cloud access policy. By Friday, a revised security procedure