2. Cyber Risk Modeling and Decision Analytics

Introduction and Context

Cybersecurity decisions are often made under conditions of incomplete information. An organization may know that a payment platform is exposed to the internet, that a vulnerability exists in its software, or that employees are targeted by phishing campaigns. It may not know precisely when an attack will occur, whether the attack will succeed, how much damage it will cause, or which safeguard will reduce the risk most efficiently. Cyber risk modeling provides a disciplined way to reason about these uncertainties.

Risk modeling is more than the production of a risk register. It connects business assets, threats, vulnerabilities, controls, uncertainty, financial consequences, and management decisions. Decision analytics extends this process by helping leaders compare alternatives: whether to invest in multifactor authentication, replace a legacy system, purchase cyber insurance, improve detection capability, or accept a residual risk.

A mature approach distinguishes between a threat and a vulnerability, between inherent and residual risk, and between a control's theoretical presence and its demonstrated effectiveness. It also recognizes that numerical precision does not automatically produce accuracy. A model is useful only when its assumptions are transparent, its data are credible, and its results support a decision.

This chapter develops a practical and analytical approach to cyber risk. It introduces qualitative assessment, quantitative methods, FAIR, Bayesian reasoning, Monte Carlo simulation, risk metrics, key risk indicators, and cost-benefit analysis. The emphasis is on interpretation: the purpose of analysis is not to create impressive numbers, but to improve the quality, defensibility, and timing of security decisions.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain the relationships among assets, business processes, threats, vulnerabilities, controls, likelihood, impact, and risk.

2. Construct a defensible cyber risk scenario and distinguish inherent, current, and residual risk.

3. Apply qualitative and quantitative risk assessment methods appropriately.

4. Explain the logic of FAIR, Bayesian updating, and Monte Carlo simulation.

5. Interpret risk metrics, key risk indicators, and uncertainty ranges.

6. Evaluate security investments using cost-benefit and decision-analytic reasoning.

7. Identify model limitations, governance requirements, and ethical concerns.

8. Apply cyber risk methods to an organizational case.

From Security Events to Decision-Relevant Risk

Risk is commonly expressed as a relationship between the likelihood of an adverse event and its consequence. In a simple formulation:

Risk = Likelihood × Impact

This expression is useful pedagogically, but real cyber risk is more complex. Likelihood may involve the frequency of threat events and the probability that a threat event produces a loss. Impact may include lost revenue, response costs, regulatory exposure, legal claims, safety effects, reputational damage, and long-term strategic consequences.

A risk scenario should therefore be written as a causal statement rather than as a vague label. For example: “A criminal group exploits an unpatched internet-facing application, obtains privileged access to the customer database, and causes confidentiality and regulatory losses.” This scenario identifies the threat actor, entry route, asset, consequence, and causal pathway.

The principal elements are:

• Asset: Something valuable to the organization, including data, systems, services, people, facilities, intellectual property, or organizational capabilities.
• Business process: An activity that creates value and depends on assets, such as payment processing, manufacturing, clinical care, or customer support.
• Threat: A condition, actor, or event capable of causing harm.
• Threat event: An occurrence, such as credential theft, exploitation, insider misuse, or denial of service.
• Vulnerability: A weakness that can be exploited or that increases the probability or severity of loss.
• Control: A safeguard intended to prevent, detect, contain, respond to, or recover from an adverse event.
• Loss event: The point at which a threat action produces a harmful effect.
• Inherent risk: Exposure before considering controls.
• Residual risk: Exposure remaining after controls operate.

These elements should not be treated as interchangeable. A vulnerability is not itself a loss, and the presence of a threat does not establish that an incident will occur. Likewise, a control may reduce frequency, magnitude, or both. Backups, for instance, may not prevent ransomware but can reduce recovery time and data restoration costs.

Scoping the Risk Model

A risk model begins with scope. The analyst must define the organizational unit, system, business process, time horizon, loss types, and decision under consideration. A model for a cloud-based payment service may focus on annual operational and regulatory losses, whereas a model for an industrial control system may include safety and production consequences over a five-year investment period.

Asset analysis should begin with business value rather than only technical inventory. A server may be low value in isolation but critical because it supports a high-value process. Dependency mapping is therefore important. It identifies relationships among applications, identities, networks, suppliers, data stores, and external services.

Threat analysis considers capability, motivation, access, persistence, and opportunity. Threat intelligence can inform these judgments, but analysts should avoid assuming that a known threat actor will necessarily target the organization. Vulnerability analysis examines exploitability, exposure, privilege requirements, compensating controls, and the time between vulnerability discovery and remediation.

Control analysis asks four questions:

1. Is the control designed to address the relevant risk?

2. Is it implemented in the intended environment?

3. Does it operate consistently and correctly?

4. What measurable effect does it have on frequency or impact?

This approach prevents a common error: assigning a high control rating merely because a policy exists. A documented policy is evidence of design, not necessarily evidence of effective operation.

Qualitative Assessment and Its Uses

Qualitative assessment uses categories such as low, moderate, high, or critical. Likelihood and impact may be scored on ordinal scales, often from one to five, and combined in a matrix. Qualitative methods are valuable when data are limited, when rapid prioritization is required, or when the assessment concerns emerging threats for which historical loss data are sparse.

A good qualitative method defines each category. For example, “high likelihood” might mean that a relevant event is expected within a year under current exposure, while “high impact” might mean material disruption of a critical service or substantial legal and financial consequences. Without such definitions, scores become expressions of personal opinion.

Risk matrices should be used carefully. They can conceal the difference between risks with very different distributions. A scenario with a frequent, moderate loss may receive the same rating as a rare, catastrophic loss. The matrix also tends to imply false precision when scores are multiplied even though the underlying categories are not numerical measurements.

Qualitative workshops are most effective when participants identify assumptions, evidence, confidence levels, and disagreement. A useful assessment may report: “High impact, medium likelihood, low confidence,” rather than a single unexplained number. Qualitative analysis is particularly suitable for initial screening and for selecting scenarios that warrant deeper quantitative analysis.

Quantitative Risk Analysis and FAIR

Quantitative analysis estimates risk using numerical values, distributions, and financial or operational measures. It supports decisions involving budgets, insurance, service-level commitments, and comparative investment. The challenge is not to eliminate uncertainty but to represent it honestly.

The Factor Analysis of Information Risk (FAIR) framework decomposes risk into measurable factors. Its central logic distinguishes:

• Loss event frequency (LEF): How often loss events are expected to occur.
• Threat event frequency (TEF): How often threat events occur or are attempted.
• Vulnerability: The probability that a threat event becomes a loss event, influenced by threat capability and resistance strength.
• Loss magnitude (LM): The probable size of loss when a loss event occurs.
• Primary loss: Direct effects, such as response, replacement, restoration, and productivity costs.
• Secondary loss: Consequences involving external stakeholders, such as litigation, regulatory action, customer compensation, or reputational effects.

A simplified annualized loss expectancy can be represented as:

Annualized Loss Expectancy = Annual Event Frequency × Loss Magnitude

However, both terms are uncertain. A responsible FAIR analysis uses ranges or probability distributions rather than a single unsupported estimate. For example, annual loss event frequency may be modeled between 0.2 and 0.6 events, while loss magnitude may range from $500,000 to $3 million depending on duration and affected records.

FAIR is not a database of universal values. It is a structured vocabulary and analytical method. Its credibility depends on the quality of estimates, the separation of frequency from magnitude, and the documentation of assumptions.

Bayesian Reasoning in Cybersecurity

Bayesian reasoning provides a formal method for updating beliefs when new evidence becomes available. It is useful because cybersecurity judgments are rarely made from complete information.

The basic relationship is:

Posterior probability ∝ Prior probability × Likelihood of evidence

A prior expresses what was believed before new evidence. Evidence might include a detection alert, threat intelligence report, failed login pattern, vulnerability exploit code, or result of a control test. The posterior is the updated belief after considering that evidence.

Suppose an organization initially estimates a 10 percent probability that a suspicious authentication pattern represents a genuine account compromise. A high-quality endpoint alert is much more likely when compromise is present than when it is absent. The alert should increase the estimated probability, although the exact posterior depends on false-positive and false-negative rates.

Bayesian reasoning also supports control evaluation. If a detection system generates few alerts during a period of low observed incident activity, analysts must consider whether the environment was genuinely safe or whether the system failed to detect events. The evidence is interpreted through the reliability of the observation process.

Bayesian models can become complex when events are dependent. Multiple alerts generated by the same underlying event should not be treated as independent evidence. Likewise, historical incident counts may be biased by changes in reporting, monitoring, or attacker behavior. Bayesian analysis is therefore as much about causal assumptions and data quality as about formulas.

Monte Carlo Simulation and Uncertainty

Monte Carlo simulation estimates the distribution of possible outcomes by repeatedly sampling from specified input distributions. It is appropriate when risk depends on several uncertain variables, such as event frequency, downtime, number of affected records, recovery duration, and legal cost.

A typical simulation proceeds as follows:

1. Define the risk scenario and time horizon.

2. Identify uncertain input variables.

3. Assign probability distributions based on evidence and expert judgment.

4. Sample one value for each variable.

5. Calculate the resulting loss.

6. Repeat the process many times.

7. Examine the resulting loss distribution.

The output may show a median annual loss, a 90th percentile loss, and the probability that losses exceed a specified threshold. The mean is useful for expected-value decisions, but it may hide severe tail outcomes. A board may care greatly about the probability of exceeding a solvency or regulatory threshold even when the average loss appears manageable.

Simulation results should never be presented without sensitivity analysis. If the result changes substantially when recovery time is altered, recovery capability is a critical driver. Analysts should also test correlations. For example, major incidents may simultaneously increase downtime, response cost, and legal exposure; treating these variables as independent can understate extreme outcomes.

Metrics, KRIs, and Model Interpretation

Risk metrics summarize exposure, performance, or outcomes. Examples include mean time to detect, mean time to contain, critical vulnerabilities past due, privileged accounts without multifactor authentication, percentage of recoverable systems tested, phishing reporting rate, and annualized loss exposure.

A key risk indicator (KRI) is a forward-looking measure that signals increasing exposure or declining control effectiveness. A key performance indicator may show that a security team closed 95 percent of tickets on time, whereas a KRI may show that the number of internet-facing assets with unsupported software is rising. The distinction is not absolute, but the decision purpose differs.

Useful KRIs have defined thresholds, owners, data sources, reporting frequency, and escalation actions. A threshold without an action is merely a statistic. Metrics should also be normalized where possible. Counting vulnerabilities alone may be misleading; severity, exposure, exploit availability, asset criticality, and compensating controls are relevant.

Management should examine trends and relationships rather than isolated values. A reduction in detected incidents may indicate improved security—or reduced monitoring. A high patch-compliance rate may conceal the continued exposure of a small number of critical systems. Metrics require context, validation, and careful interpretation.

Security Investment and Cost-Benefit Analysis

Security investment decisions compare alternatives under uncertainty. Common options include prevention, detection, response, resilience, outsourcing, insurance, and risk acceptance. A control should not be judged only by whether it reduces a technical vulnerability; it should be evaluated by its effect on business loss and decision objectives.

A basic expected-value comparison is:

Expected Net Benefit = Expected Loss Reduction − Control Cost

Control cost should include acquisition, implementation, integration, training, maintenance, staffing, user friction, and opportunity cost. Expected loss reduction may result from lower event frequency, lower loss magnitude, or faster recovery.

For a multi-year decision, organizations may use net present value, incorporating the timing of costs and benefits. They should also consider non-financial constraints such as legal requirements, safety, contractual obligations, and risk appetite. A control with a negative narrow financial return may still be mandatory or strategically necessary.

Decision trees are useful when choices lead to different future states. For example, an organization may choose to remediate immediately, defer remediation while monitoring, or transfer part of the risk through insurance. Each branch can include probabilities, costs, and outcomes. Real options reasoning may be relevant when a staged investment preserves the ability to expand later as more evidence becomes available.

The most important analytical question is often not “What is the exact return on investment?” but “Which decision produces an acceptable risk profile under plausible assumptions?”

Illustrative Case: Securing a Regional Healthcare Provider

Background

Northbridge Health, a fictional regional healthcare provider, operates hospitals, clinics, and a patient portal. Its electronic health record system depends on centralized identity services and several external software suppliers. The organization has endpoint protection and annual security training, but multifactor authentication is not required for all remote access. Backup restoration tests are inconsistent.

Situation and Problem

A risk committee must decide whether to invest $1.4 million in a two-year program combining multifactor authentication, privileged-access management, immutable backups, and recovery exercises. The chief financial officer requests evidence that the program is more valuable than adding security staff or purchasing additional insurance.

The security team identifies a ransomware scenario involving stolen credentials and inadequate recovery preparation. Historical data show frequent attempted attacks but limited reliable evidence about successful events. The team therefore avoids treating attempted attacks as confirmed losses.

Analysis

The scenario is decomposed into threat event frequency, probability of credential compromise, probability of successful privilege escalation, and loss magnitude. Without the proposed program, the estimated annual loss event frequency is modeled between 0.15 and 0.35 events. Loss magnitude is estimated between $2 million and $8 million, including downtime, restoration, notification, and patient-service disruption. These estimates are uncertain, so the team uses distributions in a Monte Carlo model.

Control analysis suggests that multifactor authentication primarily reduces the probability of account compromise. Privileged-access management reduces escalation opportunities. Immutable backups and restoration exercises have less effect on event frequency but substantially reduce downtime and recovery uncertainty. Insurance may offset some financial losses but does not restore clinical operations or remove regulatory responsibilities.

The simulation indicates that the proposed program lowers both expected annual loss and the probability of an extreme loss. Sensitivity analysis shows that recovery duration is the largest driver of the upper tail. This result changes the discussion: resilience investment is not merely a technical backup project but a way of reducing operational and patient-care consequences.

Approach and Decision

The committee approves the program in stages. Multifactor authentication and privileged-access controls are implemented first for remote and administrative access. Immutable backups and recovery exercises follow, with quarterly tests reported to senior management. Insurance is retained, but its role is treated as financial transfer rather than prevention or recovery.

KRIs include privileged accounts without strong authentication, percentage of critical systems covered by tested immutable backups, restoration time for priority services, and overdue remediation of exposed systems. Threshold breaches trigger executive review.

Outcome

After the first year, the organization has not eliminated ransomware risk, but it has reduced the most consequential pathways and demonstrated recovery capability. The committee regards the investment as justified not because the model predicted a precise loss, but because multiple methods pointed to the same conclusion and the program addressed the dominant risk drivers.

Learning Points

The case illustrates five principles. First, a scenario should connect threat action to business consequence. Second, attempted attacks are not equivalent to loss events. Third, controls may reduce frequency, magnitude, or both. Fourth, tail risk and recovery time can matter more than average loss. Finally, decision analytics should support staged governance, measurable ownership, and reassessment rather than a one-time approval.

Challenges, Limitations, and Common Errors

Risk models can fail through poor scope, weak data, hidden assumptions, or misuse by decision-makers. Common errors include double-counting controls, treating vulnerability counts as risk, using historical incidents without accounting for under-reporting, and presenting a single point estimate as an objective truth.

Another problem is model risk: uncertainty about whether the model itself represents reality. A detailed simulation may still be misleading if it omits supplier dependency, assumes independence where events are correlated, or excludes secondary losses. Analysts should document assumptions, confidence, data provenance, distribution choices, and sensitivity results.

Organizations may also create perverse incentives. If managers are rewarded for reducing reported incidents, they may discourage reporting or suppress inconvenient information. Metrics should therefore be designed to encourage transparency and learning.

Risk appetite must be explicit. A board may accept frequent minor disruptions but reject a small probability of prolonged disruption to a critical service. Risk acceptance should be a documented decision by an authorized owner, not the default result of an unfunded recommendation.

Governance, Ethics, and Regulation

Cyber risk analysis involves personal, operational, and sometimes safety-sensitive information. Analysts must limit data collection, protect confidential information, and avoid using individual behavior metrics in ways that are disproportionate or discriminatory. Employee monitoring should have a legitimate purpose, clear notice, appropriate access controls, and retention limits.

Governance requires separation between analysis and approval where practical. Security teams may estimate risk, but business owners should determine the significance of service disruption, and accountable executives should approve acceptance or investment decisions. Internal audit and independent review can test whether models are consistently applied.

Regulatory and contractual requirements may establish minimum safeguards or reporting duties. Quantitative analysis cannot be used to justify ignoring mandatory controls. It can, however, help prioritize implementation, demonstrate due diligence, and explain residual risk.

Technology, Automation, and Emerging Developments

Modern security platforms increasingly automate asset discovery, vulnerability prioritization, attack-path analysis, control testing, and exposure monitoring. Machine-learning systems can identify anomalous behavior and support Bayesian-style updating, but their outputs remain dependent on training data, configuration, and changing attacker behavior.

Attack-surface management can enrich risk models with internet exposure, identity relationships, cloud configuration, and software dependencies. Digital twins and graph-based models can represent how compromise may propagate through an organization. Automated control evidence can reduce assessment effort, although automation does not guarantee that a control is effective in practice.

Generative AI introduces additional decision challenges. It may accelerate scenario construction, summarization, and analysis, but it can produce unsupported estimates, overlook dependencies, or expose confidential information. AI-assisted risk analysis should use approved data, human review, traceable assumptions, and validation against observed results.

Emerging practice is moving toward continuous risk quantification. Rather than conducting an annual assessment alone, organizations update exposure as assets change, vulnerabilities are exploited, controls degrade, and threat intelligence evolves. Continuous assessment must still avoid alert fatigue and excessive metric collection. The objective remains better decisions, not uninterrupted measurement.

Best Practices for Decision-Ready Risk Modeling

A defensible program generally follows these practices:

1. Start with business processes and decisions, not with a list of tools.

2. Define scenarios clearly and distinguish threats, vulnerabilities, controls, and losses.

3. Use qualitative methods for screening and quantitative methods where decisions justify the effort.

4. Express uncertainty through ranges or distributions and document confidence.

5. Separate event frequency from loss magnitude.

6. Test correlations, dependencies, and sensitivity to key assumptions.

7. Measure control operation and outcomes, not only policy existence.

8. Report both expected loss and tail-risk measures.

9. Link KRIs to owners, thresholds, and escalation actions.

10. Reassess models after major changes, incidents, control failures, or new evidence.

11. Present alternatives, including acceptance, transfer, reduction, and avoidance.

12. Preserve an auditable record of assumptions, data, approvals, and decisions.

Chapter Summary

Cyber risk modeling translates uncertain technical and threat conditions into structured decisions about business exposure. Effective analysis begins by identifying assets and processes, constructing realistic risk scenarios, and distinguishing threats, vulnerabilities, controls, and losses. Qualitative methods support rapid prioritization, while quantitative methods estimate frequency, magnitude, distributions, and uncertainty.

FAIR provides a decomposition of loss event frequency and loss magnitude. Bayesian reasoning supports belief updates as evidence changes, and Monte Carlo simulation represents the range of possible outcomes. Metrics and KRIs help organizations monitor exposure and control performance, but they require context and defined actions. Cost-benefit analysis compares investments by considering expected loss reduction, total cost, residual risk, regulatory duties, and organizational risk appetite.

The central lesson is that risk models are decision instruments, not predictions of certainty. Their value depends on transparent assumptions, credible evidence, sensitivity analysis, governance, ethical use of data, and continuous reassessment. A mature organization uses analytics to make security investment more proportionate, explainable, and resilient to uncertainty.

Key Terms

Asset: A resource, capability, system, person, or information that has value to an organization.

Threat: An actor, condition, or event capable of causing harm.

Threat event: An occurrence in which a threat acts or attempts to act against an environment.

Vulnerability: A weakness that may be exploited or increase the chance or impact of loss.

Control: A safeguard that prevents, detects, responds to, contains, or recovers from risk.

Inherent risk: Risk considered before the effect of controls.

Residual risk: Risk remaining after controls are applied.

Loss event: An event that produces an actual adverse consequence.

Loss event frequency: The expected frequency with which loss-producing events occur.

Loss magnitude: The size of loss associated with an event.

FAIR: A quantitative information-risk analysis framework that decomposes frequency and magnitude.

Bayesian reasoning: A method for updating probability beliefs using new evidence.

Monte Carlo simulation: Repeated random sampling used to estimate a distribution of possible outcomes.

Risk appetite: The amount and type of risk an organization is willing to accept.

Key risk indicator: A measure that signals changing exposure or declining control effectiveness.

Annualized loss expectancy: Expected loss over a year, commonly estimated from event frequency and loss magnitude.

Primary loss: Direct loss resulting from a cyber event.

Secondary loss: Loss arising through external stakeholders, such as regulators, customers, or litigants.

Model risk: The possibility that a model is incorrect, incomplete, or misapplied.

Residual risk acceptance: A formally authorized decision to retain remaining exposure.

Review Questions

Short Answer Questions

1. Distinguish a threat, a vulnerability, and a loss event.

2. What is the difference between inherent risk and residual risk?

3. Why should a risk scenario be written as a causal statement?

4. Define loss event frequency and loss magnitude in FAIR.

5. What makes a metric a useful key risk indicator?

Long Answer Questions

1. Explain how asset, process, threat, vulnerability, and control analysis combine to produce a decision-ready risk assessment.

2. Compare qualitative risk matrices with quantitative risk analysis, including the strengths and weaknesses of each.

3. Explain Bayesian reasoning and Monte Carlo simulation in the context of cyber risk assessment.

4. Discuss how cost-benefit analysis should account for control cost, uncertainty, residual risk, and non-financial obligations.

5. Examine the governance and ethical requirements for using employee, operational, and security data in risk models.

Analytical / Application Questions

1. A company has frequent phishing attempts but no confirmed financial loss. Construct a risk scenario and identify the evidence needed to estimate event frequency, vulnerability, and loss magnitude.

2. A proposed control reduces the probability of compromise but has little effect on recovery time. Explain how this control should be represented in a quantitative model and what additional control might address the remaining exposure.

3. A Monte Carlo model shows a modest average annual loss but a high probability of a severe loss exceeding the organization’s risk tolerance. What should management investigate and how should the investment decision be framed?

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from a loss event?

A. A vulnerability is a weakness; a loss event is an occurrence that produces harm.

B. A vulnerability is always caused by an external attacker; a loss event is always internal.

C. A vulnerability measures financial impact; a loss event measures control maturity.

D. A vulnerability is residual risk; a loss event is inherent risk.

Correct Answer: A. A vulnerability is a weakness; a loss event is an occurrence that produces harm.

Question 2

In a FAIR analysis, which factor represents the expected size of loss when a loss event occurs?

A. Threat event frequency

B. Loss magnitude

C. Vulnerability

D. Control coverage

Correct Answer: B. Loss magnitude

Question 3

Why can a risk matrix give a misleading comparison between two risks?

A. It cannot use qualitative categories.

B. It always excludes controls.

C. It may assign the same rating to frequent moderate loss and rare catastrophic loss.

D. It requires Monte Carlo simulation.

Correct Answer: C. It may assign the same rating to frequent moderate loss and rare catastrophic loss.

Question 4

What is the principal purpose of Bayesian reasoning in cyber risk analysis?

A. To eliminate uncertainty from a model

B. To update probability estimates when new evidence becomes available

C. To calculate only the cost of security controls

D. To replace all expert judgment with historical data

Correct Answer: B. To update probability estimates when new evidence becomes available

Question 5

Which activity is essential in a Monte Carlo simulation?

A. Assigning a single certain value to every input

B. Repeatedly sampling from defined input distributions

C. Ignoring correlations among variables

D. Reporting only the maximum possible loss

Correct Answer: B. Repeatedly sampling from defined input distributions

Question 6

A backup control does not greatly reduce the chance of ransomware but reduces restoration time. In a risk model, its principal effect is likely to be on:

A. Threat motivation

B. Loss magnitude

C. Threat event frequency

D. Asset ownership

Correct Answer: B. Loss magnitude

Question 7

Which is the strongest example of a forward-looking KRI?

A. Number of incidents reported last year

B. Total security training sessions completed since 2020

C. Number of critical internet-facing assets with overdue patches

D. Total annual security expenditure

Correct Answer: C. Number of critical internet-facing assets with overdue patches

Question 8

A security investment has a cost of $500,000 and is expected to reduce annual losses by $750,000, before considering other obligations. What is its simplified expected net benefit?

A. $250,000

B. $500,000

C. $750,000

D. $1,250,000

Correct Answer: A. $250,000

Question 9

Why should an analyst conduct sensitivity analysis on a risk model?

A. To make every estimate appear precise

B. To identify which assumptions and variables most influence the result

C. To remove the need for governance approval

D. To ensure that all variables are independent

Correct Answer: B. To identify which assumptions and variables most influence the result

Question 10

Which decision best reflects mature cyber risk governance?

A. Accepting all risks that fall below a technical severity threshold

B. Allowing the security team alone to approve residual risk

C. Documenting assumptions, assigning an authorized risk owner, and linking thresholds to action

D. Using insurance as a substitute for prevention and recovery

Correct Answer: C. Documenting assumptions, assigning an authorized risk owner, and linking thresholds to action