A project manager identifies that a previously managed risk has materialized: a key technology vendor has announced they will discontinue support for a critical software component in twelve months, and will stop providing security updates in six months. This affects core system functionality and creates security vulnerabilities. What should the project manager do FIRST?

Update the risk register to reflect that the risk has become a critical issue

Begin immediately searching for alternative software components to replace the discontinued one

Assess the immediate security implications and long-term functionality impact, then collaborate with stakeholders to determine the optimal response strategy

Implement the pre-planned risk response that was developed when this vendor discontinuation risk was first identified