2. Enterprise Risk Management and Cybersecurity Strategy

Introduction and Context

Cybersecurity is often treated as a technical function concerned with firewalls, encryption, vulnerability management, and incident response. That view is incomplete. A cyber event can interrupt production, expose regulated information, undermine public trust, trigger contractual penalties, affect employee safety, and reduce the value of an acquisition. Consequently, cybersecurity risk is also an enterprise risk: it can influence strategic objectives, financial performance, legal position, operational resilience, and reputation.

Enterprise risk management (ERM) provides the organizational setting in which these consequences can be understood and managed. ERM does not replace cybersecurity risk management. Rather, it connects cybersecurity decisions with the organization’s objectives, risk capacity, governance structures, investment priorities, and broader portfolio of uncertainties. The central managerial question is not simply whether a vulnerability exists, but whether the risk created by that vulnerability is acceptable in relation to the organization’s objectives and available resources.

This chapter examines cybersecurity through four complementary perspectives. The agency perspective focuses on conflicts between owners, managers, and other decision-makers. The stakeholder perspective recognizes that cyber decisions affect customers, employees, suppliers, regulators, communities, and partners. The institutional perspective explains how laws, standards, professional expectations, and industry practices shape organizational behaviour. The systems perspective treats the organization as an interconnected socio-technical system in which technical, human, process, and external dependencies interact.

The chapter then integrates these perspectives with ERM and strategic management. Particular attention is given to risk capacity, risk appetite, risk tolerance, ownership, strategic alignment, digital transformation, governance, and the use of technology and analytics in decision-making.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain why cybersecurity risk must be integrated with enterprise risk management.

2. Apply agency, stakeholder, institutional, and systems perspectives to cyber risk decisions.

3. Distinguish risk capacity, appetite, tolerance, exposure, ownership, and acceptance.

4. Align cybersecurity strategy with organizational objectives and digital transformation.

5. Evaluate governance structures, risk decisions, controls, and accountability mechanisms.

6. Analyse the strategic implications of a cybersecurity risk scenario.

7. Identify common mistakes, ethical issues, and emerging practices in cyber risk governance.

Cybersecurity as an Enterprise Risk

Risk is commonly understood as the effect of uncertainty on objectives. This definition is important because it places objectives before controls. A control is valuable only in relation to what the organization is trying to protect or achieve. For example, a retailer expanding its online platform may accept some operational experimentation, but it may have very low tolerance for unauthorized disclosure of payment data. A hospital may prioritize availability and patient safety over short-term cost reduction. A research institution may place exceptional importance on confidentiality and intellectual property.

Cybersecurity risk arises when threats, vulnerabilities, dependencies, or control weaknesses could affect organizational objectives. The source may be malicious, accidental, technical, environmental, or organizational. Threats include ransomware, fraud, espionage, insider misuse, supply-chain compromise, social engineering, and disruption of cloud services. Vulnerabilities may involve outdated software, excessive privileges, inadequate monitoring, insecure application design, poor supplier oversight, or ineffective recovery arrangements.

A useful distinction is between inherent risk and residual risk. Inherent risk is the level of exposure before considering controls. Residual risk is the exposure remaining after controls and risk treatments have been applied. Neither concept is absolute. Risk estimates depend on assumptions about threat capability, likelihood, impact, control effectiveness, and the time horizon being considered.

Cybersecurity risk differs from many traditional enterprise risks in several ways. It is often highly interdependent, difficult to observe directly, capable of propagating across organizational boundaries, and subject to rapid change. A weakness in one supplier may affect many customers. A single compromised credential may provide access to several systems. A seemingly minor software defect may become significant when combined with a business process failure and an unavailable backup.

For this reason, a cybersecurity dashboard containing only the number of blocked attacks or unresolved vulnerabilities cannot represent enterprise exposure adequately. Senior decision-makers need information about business services, critical dependencies, probable consequences, recovery capability, control effectiveness, and the relationship between cyber risk and strategic objectives.

Four Perspectives for Understanding Cyber Risk

The agency perspective

Agency theory examines relationships in which one party, such as an owner or board, delegates authority to another party, such as management. Because decision-makers may have different information, incentives, and preferences, managers may not always act in the way owners or other principals would choose. In cybersecurity, this problem can appear when managers defer expensive improvements, underreport weaknesses, or emphasize visible short-term performance over resilience.

A chief information officer may understand that a legacy platform is unsafe, while the business unit controlling the budget prefers to postpone replacement. A security manager may report high risk, but operational managers may fear that escalation will affect performance evaluations. These conditions create information asymmetry and moral hazard. Governance responses include independent assurance, transparent risk reporting, clearly assigned accountability, audit committees, escalation thresholds, and incentives that reward resilience rather than the absence of reported incidents.

Agency analysis also applies to outsourcing. When security operations, cloud hosting, software development, or data processing are delegated to suppliers, the organization must address information asymmetry and incentive differences through contracts, assurance rights, service-level requirements, incident notification clauses, and oversight.

The stakeholder perspective

The stakeholder perspective asks who may be affected by an organization’s decisions, even when those parties do not control the organization. Cybersecurity decisions can affect customers whose data are processed, employees whose identities may be exposed, suppliers whose systems are connected, regulators responsible for public protection, and communities dependent on essential services.

This perspective broadens the meaning of impact. A decision to collect more personal data may produce commercial value but also increase privacy risk. A decision to shut down a service during an incident may protect systems while disadvantaging vulnerable users. A decision to disclose a breach involves legal, ethical, operational, and reputational considerations.

Stakeholder analysis does not mean that every interest receives equal weight in every situation. It requires the organization to identify affected groups, understand their legitimate expectations, evaluate competing interests, and document the basis for decisions. Stakeholder mapping is particularly useful when cyber risks involve safety, privacy, critical infrastructure, or public trust.

The institutional perspective

Organizations operate within institutions: laws, regulations, standards, professional norms, market expectations, and accepted practices. These institutions influence what organizations regard as responsible cybersecurity. Regulatory requirements concerning privacy, critical infrastructure, financial services, health information, or incident reporting can establish minimum expectations. Standards and frameworks can provide common language and control structures. Industry practices can influence procurement, assurance, and board reporting.

Institutional pressure may be coercive, normative, or mimetic. Coercive pressure results from law, regulation, or contractual requirements. Normative pressure arises from professional standards and expectations. Mimetic pressure occurs when organizations imitate peers, particularly when the environment is uncertain. Compliance can therefore encourage improvement, but compliance alone does not guarantee effective risk management. An organization may possess policies and certificates while failing to protect its most important services.

A mature organization distinguishes between compliance evidence and substantive risk reduction. It uses legal and regulatory requirements as constraints and inputs, not as a substitute for judgement.

The systems perspective

The systems perspective treats cybersecurity as a property of an interconnected socio-technical system. Technology, people, processes, suppliers, governance arrangements, and the external environment interact. Failures are rarely caused by one isolated defect. They often arise from combinations of conditions: a rushed software release, weak identity controls, inadequate logging, unclear ownership, and an assumption that another team is responsible.

Systems thinking encourages analysis of dependencies, feedback loops, emergent behaviour, and unintended consequences. Increasing authentication requirements may improve access control but also encourage unsafe workarounds if usability is ignored. A highly centralized security function may create consistency but become a bottleneck for innovation. Automation may reduce routine errors but amplify a flawed decision at scale.

Systems analysis is especially important for digital transformation. Cloud platforms, application programming interfaces, artificial intelligence, connected devices, and outsourced services create new connections and dependencies. The relevant boundary is not the traditional corporate network; it is the broader service ecosystem.

Integrating Cyber Risk with Enterprise Risk Management

ERM is a coordinated approach through which an organization identifies, assesses, responds to, monitors, and reports risks in relation to its objectives. It normally involves the governing body, senior management, business units, risk functions, internal audit, and operational personnel. Cybersecurity should participate in this process rather than operate as a separate technical island.

Integration can occur at several levels. At the strategic level, cyber risk is considered when objectives, markets, products, acquisitions, and transformation programmes are approved. At the portfolio level, cyber risks are compared with financial, operational, legal, supply-chain, and reputational risks. At the process level, cyber risk assessments are embedded in architecture review, procurement, project management, change management, and business continuity. At the reporting level, security information is translated into business consequences and decision-relevant indicators.

A practical ERM cycle includes:

• Establishing objectives, context, and criteria for risk decisions.
• Identifying assets, services, dependencies, threats, vulnerabilities, and opportunities.
• Analysing likelihood, impact, velocity, persistence, and control effectiveness.
• Evaluating exposure against capacity, appetite, and tolerance.
• Selecting treatment options, including avoidance, reduction, transfer, sharing, or acceptance.
• Assigning ownership, resources, deadlines, and escalation requirements.
• Monitoring changes, testing controls, and reporting outcomes.

Risk registers can support this cycle, but they should not become static administrative lists. A useful cyber risk entry identifies the affected objective or service, risk scenario, causes, consequences, current controls, residual exposure, accountable owner, treatment plan, target state, and review date.

Capacity, Appetite, Tolerance, and Acceptance

These terms are related but should not be used interchangeably.

Risk capacity is the maximum level of risk an organization can bear before its viability, solvency, legal standing, essential operations, or strategic continuity is seriously threatened. Capacity is constrained by capital, liquidity, regulatory obligations, safety requirements, recovery capability, and stakeholder commitments. It is generally a boundary rather than a preferred operating level.

Risk appetite is the amount and type of risk the organization is willing to pursue or retain in order to achieve its objectives. Appetite may differ by category. An organization may have a moderate appetite for innovation risk but a very low appetite for unlawful disclosure of personal data.

Risk tolerance is the acceptable variation around a specific objective, process, service, or risk category. Tolerance is more operational and measurable than appetite. Examples include a maximum acceptable service outage, a maximum recovery time, a maximum number of privileged accounts, or a requirement that critical vulnerabilities be remediated within a defined period.

Risk exposure is the organization’s current or projected position in relation to a risk. Exposure changes as systems, threats, controls, suppliers, and business objectives change.

Risk acceptance is a decision to retain a particular risk, usually with knowledge of its implications and within delegated authority. Acceptance should not be confused with inaction. It should specify the risk, rationale, duration, conditions, owner, and review date.

The relationship can be represented simply:

Capacity > Appetite > Tolerance for normal operations, although the exact ordering depends on how the terms are defined and applied. Tolerance should be set at levels that allow operational flexibility without permitting unacceptable deviation from objectives. If residual exposure exceeds tolerance, escalation and treatment are required unless a properly authorized exception exists.

Ownership and Accountability

Risk ownership is the assignment of responsibility to the person or body able to make decisions about a risk. The security team may identify, analyse, and advise on a risk, but the business owner of the affected service usually owns the consequences and the decision to accept or treat the exposure. Technical ownership may be assigned to an engineering or infrastructure team, while executive accountability remains with a senior leader.

This distinction is important because security functions cannot manage risks they do not control. A security manager may recommend replacing an unsupported platform, but the service owner must provide resources, approve disruption, and accept the operational consequences. Confusion arises when organizations assign every risk to the chief information security officer. Such arrangements can create accountability without authority.

Responsibility assignment matrices, risk committees, delegated authorities, exception procedures, and escalation paths can clarify roles. A board should oversee whether management has established an effective system of risk governance; it should not normally approve every technical control.

Strategic Alignment and Digital Transformation

Strategic alignment means that cybersecurity priorities support the organization’s mission, objectives, operating model, and risk profile. Alignment does not mean that security always prevents change. It means that security enables informed change by identifying conditions under which innovation can proceed safely.

A cybersecurity strategy should answer several questions:

• Which services and information are most important to organizational success?
• What cyber outcomes are required to support the business strategy?
• Which risks are unacceptable, and which can be managed through experimentation?
• What capabilities are needed in governance, architecture, people, technology, suppliers, and recovery?
• How will investments be prioritized and their effectiveness evaluated?

Digital transformation creates both value and exposure. Moving to cloud services may improve scalability and resilience but introduces shared-responsibility, identity, configuration, and concentration risks. Artificial intelligence may improve detection and decision support but creates risks involving data quality, privacy, model manipulation, explainability, and overreliance. Internet-connected devices may improve operational insight but expand attack surfaces and create safety consequences.

Security should therefore be incorporated into transformation design rather than added after implementation. Security architecture, privacy impact assessment, threat modelling, secure software development, identity governance, resilience testing, and supplier assurance should be integrated into programme governance. The objective is not to eliminate all risk, which is impossible, but to make risk visible and manageable before commitments become difficult to reverse.

Governance Architecture for Cyber Risk

Effective governance distributes authority while preserving coordination. The board or governing body sets expectations, oversees risk, and challenges management. Executive management establishes strategy, allocates resources, and makes decisions within approved appetite. The chief information security officer provides expertise, coordinates security capabilities, and reports material exposure. Business and service owners manage risks in their domains. Risk and compliance functions provide independent challenge and aggregation. Internal audit provides assurance on governance, risk management, and control effectiveness.

A three-lines model is often useful. The first line owns and manages risk in operational activities. The second line provides frameworks, advice, monitoring, and challenge. The third line provides independent assurance. External auditors, regulators, customers, and specialist assessors may provide additional assurance but do not replace internal accountability.

Board reporting should be concise but meaningful. Useful information includes trends in material exposures, progress against treatment plans, resilience of critical services, significant incidents, supplier concentration, results of exercises, and exceptions exceeding tolerance. Metrics should have a defined purpose and owner. Counting events without interpreting business significance can create false reassurance.

Applied Scenario: Northbridge Health Network

Background

Northbridge Health Network is an illustrative regional healthcare provider operating hospitals, outpatient clinics, diagnostic laboratories, and a patient portal. Its strategy includes expanding remote consultations, integrating clinical information systems, and using cloud analytics to improve patient flow. The organization has a centralized security team, but many clinical applications are managed by separate departments and suppliers.

Situation

A vulnerability is identified in a legacy diagnostic system connected to the clinical network. The supplier has issued a patch, but applying it requires a planned shutdown of approximately twelve hours. The clinical engineering team argues that immediate disruption could delay urgent diagnostic procedures. The security team reports that exploitation could permit unauthorized access to patient information and potentially disrupt connected services. The board is scheduled to review the organization’s cyber risk appetite in two months.

Analysis

The agency perspective highlights a possible conflict between operational performance targets and patient-protection obligations. The stakeholder perspective identifies patients, clinicians, families, suppliers, regulators, and emergency services as affected parties. The institutional perspective introduces privacy, healthcare safety, contractual, and reporting requirements. The systems perspective shows that the diagnostic system is not isolated: it depends on network identity, supplier support, clinical workflows, and recovery procedures.

The organization first identifies the critical objectives: patient safety, continuity of essential diagnosis, confidentiality of health information, and regulatory compliance. It then assesses the inherent risk, existing segmentation, monitoring, backup arrangements, supplier evidence, and exploitability. The decision cannot be based solely on the vulnerability score. The organization must consider the business service, exposure window, compensating controls, and consequences of both patching and delaying.

Approach and strategy

The executive risk committee designates the clinical service executive as risk owner, with the chief information security officer and clinical engineering lead as advisers and treatment owners. The organization chooses a staged response:

1. Isolate the affected system from unnecessary network paths.

2. Increase monitoring and establish an incident escalation trigger.

3. Validate backups and test restoration of the diagnostic service.

4. Schedule patching during a period of lower clinical demand.

5. Arrange temporary alternative diagnostic capacity.

6. Conduct a post-change security and safety review.

7. Record the temporary exception, its rationale, expiry date, and approval authority.

The decision is communicated to affected clinicians and relevant stakeholders. If evidence of active exploitation appears, the tolerance threshold is exceeded and the response changes to immediate containment, even if service disruption results.

Outcome

The organization reduces exposure before patching, preserves essential clinical capability through alternative arrangements, and avoids treating the security team as the sole risk owner. The case also reveals a strategic issue: critical clinical systems were not consistently inventoried or classified, and cyber resilience had not been integrated into digital transformation governance.

Learning points

The scenario demonstrates that risk appetite must be translated into service-specific tolerances. It also shows why ownership, stakeholder analysis, compensating controls, resilience testing, and documented exceptions matter. A technically correct control decision can still be strategically poor if it ignores patient safety or operational dependencies.

Challenges and Common Mistakes

One common mistake is equating compliance with security. A completed checklist may demonstrate that a process exists but not that a critical service can withstand disruption. Another is treating vulnerability counts as a direct measure of enterprise risk. Vulnerabilities differ substantially in exploitability, exposure, asset importance, and available compensating controls.

A third mistake is allowing risk appetite statements to remain vague. Expressions such as “low tolerance for cyber risk” are not operationally useful unless translated into decision criteria, thresholds, escalation rules, and measurable outcomes. A fourth is assigning ownership to a security function without giving it authority over budgets, architecture, or business decisions.

Organizations also make errors by focusing on prevention while neglecting detection, response, recovery, and learning. Resilience requires the ability to continue essential functions, communicate, restore trustworthy systems, and improve after disruption. Excessive centralization, fragmented responsibility, undocumented exceptions, poor supplier visibility, and untested assumptions are further sources of weakness.

Cyber risk measurement has limitations. Probabilities may be uncertain, historical data may be incomplete, and impact estimates may be contested. Quantitative models can create an appearance of precision that is not justified by the evidence. Qualitative judgement remains necessary, but it should be transparent, challenged, and revisited as conditions change.

Ethical, Regulatory, and Professional Considerations

Cybersecurity decisions involve ethical duties concerning privacy, fairness, safety, transparency, and proportionality. Monitoring employees may support detection but can intrude on privacy. Automated fraud or access decisions may disadvantage particular groups if data or models are biased. Threat intelligence may involve sensitive or unlawfully obtained information. Organizations must define legitimate purposes, limit collection, protect data, and ensure appropriate oversight.

Responsible disclosure requires balancing public safety, vendor remediation, customer protection, and the risk of enabling exploitation. Incident reporting must be timely and accurate, without concealing material facts or making unsupported claims. Professionals should communicate uncertainty honestly and avoid overstating control effectiveness.

Regulatory obligations vary by jurisdiction and sector. A sound governance programme therefore maintains legal awareness, maps obligations to accountable owners, preserves evidence, and obtains specialist advice where necessary. Professional competence also requires continuing education because technical and regulatory conditions change.

Technology, Analytics, and Automation

Technology can strengthen ERM when it improves visibility and decision quality. Governance, risk, and compliance platforms can consolidate risk registers, controls, issues, exceptions, evidence, and workflows. Security information and event management systems can support detection and investigation. Attack-surface management can identify exposed assets, while identity analytics can reveal anomalous privilege use. Resilience platforms can track recovery objectives and exercise results.

Artificial intelligence can assist with classification, anomaly detection, threat analysis, control mapping, and summarization. However, automated recommendations require human oversight. Models may produce false positives, miss novel attacks, inherit bias, expose sensitive data, or be manipulated by adversaries. Organizations should document data sources, validation methods, confidence levels, decision rights, and escalation procedures. Automation should support accountable judgement rather than obscure it.

Current Developments and Emerging Trends

Several developments are reshaping enterprise cyber risk. Cloud concentration means that a failure or compromise affecting a major provider may have broad consequences. Software supply-chain risk is receiving greater attention because organizations depend on external code, libraries, platforms, and managed services. Ransomware increasingly affects operational continuity rather than only information confidentiality. Boards are also receiving more direct expectations concerning cyber oversight and resilience.

The integration of cybersecurity with enterprise resilience is becoming more important. Organizations are moving beyond perimeter defence toward identity-centred architectures, zero-trust principles, secure-by-design development, continuous control monitoring, and tested recovery. Privacy-enhancing technologies, confidential computing, and cryptographic migration planning may become strategically significant in data-intensive sectors.

These trends reinforce a central principle: cyber strategy must be adaptive. A static control catalogue cannot remain aligned with changing services, dependencies, threats, regulation, and stakeholder expectations.

Best Practices for Strategic Cyber Risk Management

Effective practice includes the following:

• Begin with critical objectives and services, not with a list of technologies.
• Maintain an accurate inventory of important assets, data, suppliers, and dependencies.
• Define capacity, appetite, tolerance, and escalation criteria in operational language.
• Assign risk ownership to decision-makers with authority and resources.
• Integrate security into investment, procurement, architecture, transformation, and change processes.
• Combine prevention with detection, response, recovery, and learning.
• Use scenario analysis and exercises to test assumptions about disruption and interdependence.
• Present board information in terms of objectives, exposure, resilience, and decisions required.
• Treat compliance as a baseline rather than proof of effective risk management.
• Record and review risk acceptance decisions, exceptions, and compensating controls.
• Apply human oversight to analytics and artificial intelligence.
• Reassess risk when business models, technologies, suppliers, regulations, or threat conditions change.

Chapter Summary

Cybersecurity is an enterprise risk because cyber events can affect strategic objectives, operations, finances, compliance, safety, and stakeholder trust. ERM provides a framework for connecting cyber exposure with organizational objectives, evaluating alternatives, assigning ownership, allocating resources, and monitoring outcomes.

Agency, stakeholder, institutional, and systems perspectives reveal different dimensions of cyber risk. Agency theory emphasizes incentives, information asymmetry, and accountability. Stakeholder analysis considers affected parties and legitimate expectations. Institutional analysis explains the influence of law, standards, and professional norms. Systems thinking highlights interdependence, feedback, and socio-technical conditions.

Risk capacity is the maximum bearable exposure; appetite describes the risk the organization is willing to pursue or retain; tolerance defines acceptable variation for a particular objective or service; and acceptance is an authorized decision to retain a specified risk. Strategic alignment requires cybersecurity to be integrated into business planning and digital transformation rather than added after implementation. Effective governance assigns ownership to those able to make decisions, provides independent challenge, uses meaningful reporting, and combines preventive controls with resilience and recovery.

Key Terms

Risk: The effect of uncertainty on objectives.

Enterprise risk management: A coordinated approach to managing risks in relation to organizational objectives.

Cybersecurity risk: The possibility that cyber threats, vulnerabilities, or dependencies will affect organizational objectives.

Inherent risk: Exposure before considering controls or treatments.

Residual risk: Exposure remaining after controls and treatments.

Risk capacity: The maximum risk an organization can bear before its viability or essential obligations are seriously threatened.

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Risk tolerance: Acceptable variation around a specific objective, service, or risk category.

Risk exposure: The current or projected position of an organization in relation to a risk.

Risk acceptance: An authorized decision to retain a specified risk.

Risk owner: The person or body accountable for managing and deciding about a risk.

Agency perspective: An approach examining delegated authority, incentives, information asymmetry, and accountability.

Stakeholder perspective: An approach considering parties affected by organizational decisions.

Institutional perspective: An approach examining the influence of law, regulation, standards, norms, and professional expectations.

Systems perspective: An approach viewing technology, people, processes, and external dependencies as an interconnected system.

Strategic alignment: The relationship between cybersecurity priorities and organizational objectives.

Digital transformation: Significant organizational change enabled by digital technologies and new operating models.

Compensating control: An alternative measure that reduces risk when a preferred control cannot be implemented immediately.

Risk treatment: An action to modify risk, including avoidance, reduction, transfer, sharing, or acceptance.

Resilience: The ability to prepare for, withstand, respond to, recover from, and learn from disruption.

Review Questions

Short Answer Questions

1. Why should cybersecurity risk be integrated with enterprise risk management?

2. Distinguish between risk capacity and risk appetite.

3. What is residual risk?

4. How does the stakeholder perspective broaden cyber risk analysis?

5. Why should risk ownership normally be assigned to a business or service owner rather than exclusively to the security team?

Long Answer Questions

1. Explain how agency, stakeholder, institutional, and systems perspectives provide complementary views of cybersecurity risk.

2. Discuss the relationship between risk capacity, risk appetite, risk tolerance, and risk acceptance.

3. Explain how cybersecurity can be aligned with digital transformation without becoming an obstacle to innovation.

4. Describe an effective governance architecture for enterprise cyber risk and explain the roles of the board, management, security, risk, and audit functions.

5. Critically evaluate the limitations of compliance checklists and vulnerability counts as measures of enterprise cybersecurity risk.

Analytical / Application Questions

1. A financial institution wants to launch a cloud-based service rapidly, but the security team identifies unresolved identity and supplier risks. Apply ERM principles to recommend a decision process, ownership model, and escalation criteria.

2. A manufacturer has a low tolerance for production interruption but a moderate appetite for technology experimentation. Develop suitable risk tolerances and governance conditions for a connected-factory project.

3. Analyse the Northbridge Health Network scenario from all four perspectives and propose two additional strategic improvements beyond the immediate patching decision.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes risk capacity from risk appetite?

A. Capacity is the current exposure, while appetite is the remaining exposure after controls.

B. Capacity is the maximum bearable risk, while appetite is the risk the organization is willing to pursue or retain.

C. Capacity applies only to cybersecurity, while appetite applies only to financial risk.

D. Capacity is set by suppliers, while appetite is set by auditors.

Correct Answer: B. Capacity is the maximum bearable risk, while appetite is the risk the organization is willing to pursue or retain.

Question 2

A business unit postpones replacement of an insecure legacy system because the manager is rewarded mainly for short-term cost savings. Which perspective most directly explains this situation?

A. Institutional perspective

B. Systems perspective

C. Agency perspective

D. Stakeholder perspective

Correct Answer: C. Agency perspective

Question 3

Which is the strongest example of a risk tolerance?

A. The organization is willing to innovate with new technologies.

B. The organization will not accept any cyber risk.

C. Critical services must be restored within four hours after a major disruption.

D. The board supports responsible digital transformation.

Correct Answer: C. Critical services must be restored within four hours after a major disruption.

Question 4

A security team identifies a serious risk in a clinical service but lacks authority to change the service or allocate funds. Who should normally own the business risk?

A. The service or business owner responsible for the affected objective

B. The most junior system administrator

C. The external auditor

D. The software vendor in every case

Correct Answer: A. The service or business owner responsible for the affected objective

Question 5

Which action best reflects a systems perspective on cybersecurity?

A. Counting only the number of malware alerts blocked by a firewall

B. Examining how technology, people, suppliers, processes, and recovery arrangements interact

C. Focusing exclusively on legal compliance

D. Assigning all cyber risks to the CISO

Correct Answer: B. Examining how technology, people, suppliers, processes, and recovery arrangements interact

Question 6

Why is compliance not sufficient evidence of effective cyber risk management?

A. Compliance requirements are never relevant to cybersecurity.

B. Compliance proves that all threats have been eliminated.

C. An organization may satisfy documented requirements while remaining unable to protect critical services effectively.

D. Compliance applies only to public-sector organizations.

Correct Answer: C. An organization may satisfy documented requirements while remaining unable to protect critical services effectively.

Question 7

A company accepts a temporary risk while a critical control is being implemented. Which practice is most appropriate?

A. Leave the risk undocumented to avoid reputational concerns.

B. Record the rationale, owner, expiry date, conditions, and approval authority.

C. Transfer ownership permanently to the internal audit team.

D. Assume that the risk disappears once management is informed.

Correct Answer: B. Record the rationale, owner, expiry date, conditions, and approval authority.

Question 8

Which board report would be most decision-relevant?

A. The total number of firewall rules created during the quarter

B. The number of security emails sent to employees

C. Trends in material exposures, critical-service resilience, treatment progress, and exceptions exceeding tolerance

D. A list of every low-severity vulnerability without business context

Correct Answer: C. Trends in material exposures, critical-service resilience, treatment progress, and exceptions exceeding tolerance

Question 9

What is a principal strategic risk of using artificial intelligence for cyber risk analysis?

A. It makes human oversight unnecessary.

B. It may produce biased, inaccurate, or manipulated recommendations while appearing authoritative.

C. It prevents organizations from collecting any data.

D. It eliminates the need for governance processes.

Correct Answer: B. It may produce biased, inaccurate, or manipulated recommendations while appearing authoritative.

Question 10

In the Northbridge Health Network scenario, why were alternative diagnostic arrangements and tested backups important?

A. They eliminated the need to patch the vulnerable system.

B. They provided resilience and reduced the operational consequences of the required security treatment.

C. They transferred all accountability to the supplier.

D. They demonstrated that the vulnerability was not a real risk.

Correct Answer: B. They provided resilience and reduced the operational consequences of the required security treatment.