An enterprise recently implemented a key risk indicator (KRI) to alert top executives of security incidents. Several security incidents were identified, but top executives were not notified. The most likely reason is that ________.
1) the incidents did not meet the KRI sensitivity threshold.
2) the KRI is not linked to a specific control.
3) the cost of maintaining the KRI is too high to justify.
4) the KRI provides results that cannot be compared over time.