7. Risk Treatment, Control Selection and Security Investment

Introduction and Context

Risk assessment does not protect an organization by itself. It identifies uncertainty, estimates possible consequences, and supports informed decisions; protection begins when the organization decides what to do about the risks that assessment reveals. Risk treatment is therefore the bridge between analysis and action. It determines whether a risk should be avoided, reduced, transferred, shared, or accepted, and translates that decision into controls, contracts, investments, and accountability.

In cybersecurity, treatment decisions are rarely simple. A security control may reduce the probability of a breach but increase operational friction. A highly resilient architecture may be technically desirable but financially unjustifiable for a low-value system. Cyber insurance may transfer some financial consequences while leaving legal, reputational, and operational consequences with the organization. Similarly, accepting a risk is not the same as ignoring it: acceptance is a deliberate governance decision supported by evidence, authority, monitoring, and review.

This chapter examines risk treatment as a managerial and technical discipline. It develops a method for selecting preventive, detective, corrective, and compensating controls; evaluates security investments through cost–benefit analysis and return on security investment (ROSI); and considers portfolio prioritization, cyber insurance, optimization, and residual-risk acceptance. The central principle is that cybersecurity investment should be proportionate to risk, aligned with organizational objectives, and defensible to stakeholders.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish risk avoidance, reduction, transfer, sharing, and acceptance.

2. Select controls according to risk, system context, control purpose, and implementation constraints.

3. Explain preventive, detective, corrective, and compensating controls and how they work together.

4. Apply cost–benefit analysis, expected-loss calculations, and ROSI to security decisions.

5. Prioritize security investments across a portfolio rather than evaluating projects in isolation.

6. Assess the role and limitations of cyber insurance and contractual risk transfer.

7. Define, document, monitor, and govern residual-risk acceptance.

8. Identify ethical, regulatory, operational, and strategic issues in security investment decisions.

From Risk Assessment to Treatment Choice

A risk can be represented conceptually as the possibility that a threat will exploit a vulnerability and produce an adverse impact. Treatment begins after the organization has established a reasonable understanding of the asset, threat scenario, likelihood, impact, existing controls, and uncertainty surrounding those estimates. The relevant decision is not simply whether a risk is “high” or “low,” but whether the organization’s exposure is compatible with its risk appetite and objectives.

Risk appetite expresses the broad amount and type of risk an organization is willing to pursue or retain. Risk tolerance describes acceptable variation around particular objectives or risk measures. A board may have very low tolerance for unauthorized disclosure of regulated personal data, while accepting moderate downtime for a noncritical internal application. These distinctions prevent security teams from treating every risk identically.

A treatment decision should answer five questions:

• What outcome is required: elimination, reduction, financial protection, operational resilience, or informed retention?
• Which controls or business changes can achieve that outcome?
• What risk remains after treatment?
• What will treatment cost, including implementation and continuing operating costs?
• Who has authority to approve the decision and who is accountable for its performance?

Treatment is iterative. New vulnerabilities, changing business processes, threat intelligence, regulatory obligations, and control failures can alter the original decision. A treatment plan should therefore include ownership, milestones, dependencies, performance measures, and a review date.

The Principal Treatment Strategies

Avoidance

Risk avoidance changes or stops the activity that creates the exposure. An organization may decide not to collect a sensitive data element, discontinue an unsafe service, refuse to connect a legacy system to the internet, or cancel a business process whose risk cannot be justified. Avoidance is the only strategy that can remove a particular risk scenario entirely, although it may create opportunity costs or introduce a different risk.

Avoidance is appropriate when the activity is not essential, the potential impact is catastrophic, or effective reduction is technically or economically impractical. It should not be used casually. Avoiding an online service may reduce cyber exposure but also deprive customers of access, weaken competitiveness, or encourage employees to adopt unauthorized alternatives.

Reduction or Mitigation

Risk reduction lowers likelihood, impact, or both through controls and resilience measures. Examples include multifactor authentication, secure configuration, network segmentation, vulnerability management, backups, incident response, and staff awareness. Most cybersecurity programs rely primarily on reduction because organizations usually cannot eliminate digital activity altogether.

Reduction may be preventive, such as blocking malicious authentication attempts, or impact-oriented, such as maintaining recoverable backups. A control can reduce risk without preventing every incident. The relevant question is whether it changes the risk sufficiently to make the remaining exposure acceptable.

Transfer

Transfer allocates specified financial or contractual consequences to another party. Cyber insurance, indemnity clauses, warranties, and outsourcing agreements are common mechanisms. Transfer does not make the underlying threat disappear. The organization may still experience service interruption, regulatory investigation, loss of trust, or management distraction even when an insurer or supplier pays some costs.

Transfer is effective only when the transferred obligation is enforceable, the counterparty is financially capable, the policy or contract covers the relevant scenario, and exclusions and limits are understood. A contract that assigns liability without requiring adequate security may provide a false sense of protection.

Sharing

Risk sharing distributes exposure, responsibility, or capability among multiple parties. It differs from pure transfer because the parties may jointly manage the risk rather than simply allocate financial liability. Examples include managed security services, industry information-sharing communities, shared cloud responsibility models, consortium-operated resilience arrangements, and joint incident-response agreements.

Sharing can improve economies of scale and access to specialist expertise. It also creates dependency, concentration, governance, and supply-chain risks. Shared responsibility must be explicit: ambiguity about who monitors, patches, reports, or responds is itself a security weakness.

Acceptance

Risk acceptance means retaining the risk with awareness and authority. Acceptance may be reasonable when the risk is low, treatment costs exceed justified benefits, a control is unavailable, or the risk is within approved tolerance. It is not a synonym for inaction. A valid acceptance decision records the scenario, assumptions, existing controls, residual exposure, business rationale, responsible approver, expiry or review date, and conditions that would trigger reconsideration.

Acceptance should be proportionate to impact. A system owner may accept a modest risk affecting a low-value application, but acceptance of a plausible event involving safety, major regulatory penalties, or critical national infrastructure normally requires senior executive or board-level authority. Security professionals have an ethical duty to communicate material consequences clearly rather than allowing acceptance to conceal inadequate planning.

Selecting Controls That Address the Actual Risk

A control is a safeguard, process, technology, or governance mechanism that modifies risk. Effective selection begins with the risk scenario, not with a catalogue of fashionable technologies. The organization should identify the threat path, the asset or process at risk, the point at which intervention is possible, the expected effect, and the assumptions on which the control depends.

Controls are often grouped by function. These categories are complementary rather than mutually exclusive.

Preventive Controls

Preventive controls seek to stop an unwanted event or reduce its probability. Examples include access control, multifactor authentication, secure software development, encryption, application allow-listing, network segmentation, input validation, security awareness, and change approval. Preventive controls are valuable because they act before damage occurs, but they are rarely perfect. Attackers may bypass them, legitimate users may misuse privileges, and configuration drift may reduce effectiveness.

Detective Controls

Detective controls identify events, deviations, or indicators of compromise. Security information and event management, endpoint detection, vulnerability scanning, audit logs, fraud analytics, intrusion detection, and access reviews are examples. Detection quality depends on visibility, reliable time synchronization, meaningful alert rules, skilled analysis, and a response capability. A detection mechanism that produces thousands of unprioritized alerts may technically function while failing operationally.

Corrective and Recovery Controls

Corrective controls contain, eradicate, repair, and restore after an event. They include incident-response procedures, malware removal, account revocation, patch deployment, disaster recovery, backup restoration, reimaging, and lessons-learned processes. Recovery controls are especially important when prevention cannot guarantee success. Backups must be protected from tampering, tested, appropriately separated, and aligned with recovery-time and recovery-point objectives.

Compensating Controls

A compensating control provides an alternative safeguard when the preferred control cannot be implemented. For example, temporary network isolation, enhanced monitoring, restricted administrative access, or manual dual approval may compensate for a legacy system that cannot support modern authentication. Compensating controls should address the same risk objective as far as practicable and should not become a permanent excuse for unmanaged technical debt. Their scope, duration, owner, and effectiveness should be documented.

Control Selection Criteria

A defensible control decision considers:

• risk reduction and residual risk;
• legal, regulatory, contractual, and policy requirements;
• control reliability, coverage, and resistance to bypass;
• implementation, licensing, integration, training, and maintenance costs;
• usability and effects on productivity;
• scalability and compatibility with architecture;
• availability of skilled personnel;
• dependencies and single points of failure;
• evidence needed for assurance and audit; and
• implications for privacy, equity, safety, and other ethical values.

Control frameworks and standards can organize control objectives and provide common language, but they do not automatically determine which controls are appropriate. A small organization may meet the same objective through a managed service that a large enterprise implements internally. Compliance can establish a floor; risk-based judgment determines whether the floor is sufficient.

Security Investment: From Cost to Value

Security expenditure is frequently judged only as a cost because its benefit is the absence or reduction of an adverse event. This creates a measurement problem: the organization cannot directly observe incidents that a control prevented, and estimates of likelihood and impact are uncertain. Financial analysis can improve decisions, but it should support rather than replace professional judgment.

Expected Loss and Annualized Loss Expectancy

A basic model estimates expected loss as:

Expected loss = probability of an event × impact if the event occurs

For recurring analysis, annualized loss expectancy (ALE) may be estimated as:

ALE = single-loss expectancy (SLE) × annual rate of occurrence (ARO)

SLE may include operational interruption, investigation, restoration, legal response, notification, penalties where applicable, lost revenue, and other measurable consequences. ARO is an estimate, not a fact. Historical data, threat intelligence, industry data, expert elicitation, scenario analysis, and simulation can inform it.

Suppose a payment service has an estimated annual loss of $600,000 from a particular account-compromise scenario. A proposed control costs $150,000 initially and $80,000 annually. If the control is expected to reduce the scenario’s annual loss by $300,000, the first-year gross benefit is $300,000 and the first-year net benefit is $70,000 after implementation and operating costs. The calculation supports investment, but decision-makers must also consider uncertainty, regulatory expectations, customer trust, and whether the control introduces new operational risks.

Cost–Benefit Analysis

Cost–benefit analysis compares the total relevant cost of treatment with its expected benefits. Costs include acquisition, implementation, integration, migration, training, staffing, maintenance, downtime, supplier management, and eventual replacement. Benefits include avoided loss, reduced recovery time, compliance enablement, improved availability, customer assurance, and sometimes increased business capability.

Benefits should not be double-counted. For example, avoided downtime may already be included in the estimated loss, while a separate claim for “improved resilience” could duplicate it. Analysis should state assumptions, time horizon, discounting approach, sensitivity ranges, and confidence level. A control with a negative expected financial return may still be necessary because law, contract, safety, or fiduciary duty requires it.

Return on Security Investment

ROSI is commonly expressed as:

ROSI = (risk reduction benefit − security investment cost) ÷ security investment cost × 100

If a control produces an estimated annual risk reduction of $300,000 and costs $230,000 in the first year, ROSI is approximately 30.4 percent. In later years, when implementation costs do not recur, the result may differ substantially.

ROSI is useful for comparing alternatives, but it has limitations. Probability estimates may be subjective, intangible losses are difficult to monetize, and a positive ROSI does not prove that the investment is the highest priority. Conversely, a negative ROSI does not justify ignoring a mandatory control. Scenario-based ranges, sensitivity analysis, and qualitative strategic factors should accompany the calculation.

Portfolio Prioritization and Optimization

Organizations rarely have enough budget or personnel to implement every desirable control. Security leaders must therefore optimize a portfolio rather than approve projects independently. Portfolio prioritization considers aggregate exposure, dependencies, shared capabilities, concentration risk, sequencing, and the relationship between projects.

A practical prioritization model can score each initiative against weighted criteria such as:

• expected reduction in severe risk;
• number and criticality of assets covered;
• legal or contractual urgency;
• threat activity and exploitability;
• implementation effort and time to value;
• dependency on other initiatives;
• reduction of systemic or concentration risk; and
• contribution to strategic business objectives.

Scores should not create false precision. A project ranked slightly below another may become more valuable if it is a prerequisite, prevents a common failure mode, or enables several future controls. Portfolio review should also protect foundational capabilities—identity management, asset inventory, logging, vulnerability management, backup, and incident response—because isolated advanced tools cannot compensate for weak fundamentals.

Optimization can be formalized as a constrained decision problem: maximize expected risk reduction and strategic value subject to budget, personnel, time, architecture, and regulatory constraints. In practice, organizations may use scenario modelling, multi-criteria decision analysis, benefit–cost ratios, or integer optimization. The mathematical method matters less than transparent assumptions and governance over trade-offs.

Cyber Insurance and Contractual Allocation

Cyber insurance can provide financial support for incident response, legal services, notification, restoration, business interruption, and selected liability exposures. It may also encourage better controls through underwriting questions, assessments, and policy conditions. However, insurance is not a substitute for security architecture or resilience.

Coverage must be examined for definitions, exclusions, sublimits, waiting periods, deductibles, claims procedures, prior-known events, war or state-sponsored activity exclusions, dependent-business interruption, regulatory treatment, and requirements concerning minimum controls. A policy may not respond if the organization materially misrepresented its security posture or failed to meet a condition. Insurance markets also change premiums, capacity, and terms as claims experience develops.

Contractual transfer requires similar care. Agreements with cloud providers, suppliers, and managed service providers should address security requirements, audit rights, incident notification, evidence preservation, subcontractors, data location, recovery obligations, liability limits, indemnities, termination assistance, and secure deletion. Liability caps may be far below the potential business impact. Contract review should therefore be integrated with supplier risk management rather than delegated entirely to procurement.

Residual Risk Acceptance and Governance

After controls are implemented, the remaining exposure is residual risk. It may arise from control limitations, uncertainty, unaddressed scenarios, exceptions, or changes in the environment. Residual-risk decisions should be recorded in a risk register or exception-management system and linked to the relevant asset, process, control, and business owner.

A sound acceptance record includes:

• the risk statement and affected assets;
• inherent and residual risk ratings;
• treatment already completed;
• reasons further treatment is disproportionate or impractical;
• legal, contractual, and customer implications;
• named risk owner and approving authority;
• compensating controls and monitoring measures;
• expiration or review date; and
• trigger events requiring escalation.

Acceptance should be time-bounded where uncertainty or remediation plans exist. Metrics may include control coverage, mean time to detect, mean time to contain, vulnerability age, backup recovery success, privileged-account exposure, or incidents associated with the accepted condition. Governance committees should review significant exceptions collectively because many individually accepted risks can combine into a material systemic exposure.

Illustrative Case Study: Selecting Treatment for a Regional Health Provider

Background

Northbridge Health Network is a fictional regional provider operating clinics, diagnostic services, and a patient portal. Its clinical systems depend on a mixture of modern cloud services and legacy devices. A recent assessment identifies a high-impact scenario: compromise of privileged credentials could permit unauthorized access to patient records and disrupt clinical scheduling.

Situation and Problem

The security team proposes a privileged-access management platform, phishing-resistant authentication for administrators, improved logging, and a managed detection service. The combined first-year cost is $1.2 million, followed by $650,000 annually. The chief financial officer questions the investment because no comparable breach has occurred in the organization. The technology team also reports that several legacy devices cannot support the preferred authentication method.

Analysis

The risk assessment estimates that a serious credential compromise could produce a single-loss exposure of approximately $4 million, including restoration, clinical disruption, legal response, and notification. Based on internal evidence and sector intelligence, the estimated annual probability is 0.20, producing an annual expected loss of $800,000. These figures are uncertain; a reasonable sensitivity range is $400,000 to $1.2 million.

The proposed architecture is expected to reduce the probability and impact of the scenario by approximately 70 percent, giving an estimated annual benefit of $560,000. On purely recurring financial terms, the proposal does not recover its first-year cost. However, the organization has regulatory duties, patient-safety concerns, and a strategic objective to expand digital care. A successful compromise could also undermine public trust in ways not fully represented in the estimate.

Approach and Strategy

The risk committee adopts a staged portfolio approach. In the first phase, it funds phishing-resistant authentication for privileged users, central logging for critical systems, emergency access procedures, and segmentation of legacy devices. The legacy devices receive a compensating-control package: restricted network paths, tightly controlled jump hosts, enhanced monitoring, and manual review of privileged activity.

In the second phase, Northbridge implements privileged-access management for high-value systems and contracts a managed detection service. The contract specifies notification time, evidence retention, escalation, service availability, and responsibilities under the shared operating model. Cyber insurance is renewed, but the policy is treated as financial support rather than as a control.

The residual risk for the legacy environment is accepted for twelve months by the chief information security officer and clinical operations executive, with board risk committee visibility. Acceptance is conditional on monthly monitoring, quarterly restoration tests, and a funded replacement plan. Any evidence of unauthorized privileged activity triggers immediate reassessment.

Outcome

The staged program reduces immediate exposure while avoiding a disruptive “all at once” implementation. It also makes the investment decision more defensible because each phase has a defined risk objective and performance measure. The organization does not claim that the risk has been eliminated. Instead, it documents the remaining exposure, assigns authority, and connects temporary acceptance to a measurable modernization plan.

Learning Points

The case demonstrates that security investment cannot be reduced to a single ROSI percentage. Financial calculations informed the choice, but patient safety, regulatory expectations, architectural constraints, and strategic enablement affected the final decision. It also illustrates the value of compensating controls, staged implementation, explicit shared responsibility, and time-limited residual-risk acceptance.

Challenges, Limitations, and Common Errors

A frequent error is selecting controls because they are popular, highly marketed, or already familiar to the security team. Another is treating compliance checklists as evidence that risk is adequately managed. Organizations may also underestimate operating costs, especially staffing, tuning, integration, and maintenance.

Risk estimates can be distorted by optimism bias, incomplete asset inventories, poor incident data, and failure to consider correlated events. A portfolio may appear diversified while depending on one identity provider, one cloud region, one supplier, or one specialist team. Security leaders should test assumptions through sensitivity analysis and scenario exercises.

Control fatigue and usability problems can encourage workarounds. Excessive authentication friction may lead users to share accounts or store credentials insecurely. Monitoring can create privacy concerns if employees are subjected to disproportionate surveillance. Automation may scale both correct and incorrect decisions, particularly where machine-learning systems produce false positives, opaque classifications, or discriminatory outcomes.

Risk acceptance is commonly misused when owners lack budget, when exceptions have no expiry, or when senior management is not told about material consequences. Conversely, excessive escalation of trivial risks can overload governance bodies and weaken attention to genuinely severe exposure. Good governance is proportionate, evidence-based, and clear about accountability.

Ethical, Regulatory, and Professional Considerations

Security treatment affects people, not merely systems. Decisions about monitoring, data retention, employee access, and automated risk scoring should respect privacy, necessity, proportionality, fairness, and due process. Security professionals should not manipulate probability estimates or omit inconvenient consequences to obtain approval for a preferred technology.

Regulatory and contractual obligations may require reasonable safeguards, timely notification, resilience, records, or demonstrable governance. These requirements differ by jurisdiction and sector, so organizations must obtain appropriate legal advice. Compliance should be integrated with risk management but should not be represented as a guarantee of security.

Professional accountability requires truthful communication of residual risk. Executives and boards need information that is sufficiently clear to make decisions without being overwhelmed by technical detail. Vendors and insurers should receive accurate information; misrepresentation can create legal, financial, and ethical consequences. Where a decision could affect safety or essential services, the threshold for acceptance should be especially demanding.

Technology, Analytics, and Emerging Practice

Modern security investment increasingly uses telemetry, automated control validation, attack-surface management, exposure analytics, and continuous control monitoring. These technologies can identify drift, prioritize exploitable weaknesses, and provide evidence that controls operate as intended. They do not eliminate the need for asset ownership, context, or human judgment.

Artificial intelligence can assist with alert triage, anomaly detection, scenario generation, and analysis of investment data. Its outputs should be validated because training data may be incomplete, models may be vulnerable to manipulation, and confidence scores are not equivalent to probability estimates. Sensitive decisions—such as blocking accounts, escalating employees, or accepting high-impact risk—require accountable human oversight.

Emerging investment patterns include zero-trust architectures, software supply-chain assurance, identity-centric security, secure-by-design development, cyber resilience engineering, and continuous authorization. These approaches emphasize reducing implicit trust and designing systems to withstand, detect, contain, and recover from compromise. Their value should still be demonstrated against business-specific risk rather than adopted as a slogan.

Best Practices for Practitioners

1. Begin with a clearly stated risk scenario and business consequence.

2. Separate inherent risk, current-control effectiveness, and residual risk.

3. Combine preventive, detective, corrective, and compensating controls where appropriate.

4. Include lifecycle, staffing, integration, and replacement costs in investment analysis.

5. Use ROSI and expected-loss analysis with sensitivity ranges rather than false precision.

6. Prioritize portfolios, dependencies, and systemic concentration—not isolated tools.

7. Treat insurance and contracts as limited financial or responsibility-sharing mechanisms.

8. Record risk acceptance with authority, conditions, monitoring, and an expiry date.

9. Test backups, response plans, detection logic, and compensating controls in practice.

10. Reassess treatment when threats, technology, business processes, or regulations change.

Chapter Summary

Risk treatment converts assessment into action by choosing whether to avoid, reduce, transfer, share, or accept exposure. Reduction is common in cybersecurity, but effective programs combine preventive, detective, corrective, recovery, and compensating controls. Control selection should be based on the risk scenario, required outcome, control effectiveness, cost, usability, dependencies, and governance obligations.

Cost–benefit analysis, expected loss, annualized loss expectancy, and ROSI help decision-makers compare investments, but uncertainty and non-financial consequences must be acknowledged. Portfolio prioritization improves outcomes by considering dependencies, shared capabilities, systemic risk, and strategic value. Cyber insurance and contracts may allocate selected financial consequences but cannot replace technical and organizational resilience. Residual-risk acceptance is legitimate only when it is informed, authorized, documented, monitored, and periodically reviewed. Sound treatment is therefore both a technical discipline and a governance responsibility.

Key Terms

Risk treatment: The process of selecting and implementing measures to modify risk.

Risk avoidance: Changing or discontinuing an activity so that a specified risk is removed.

Risk reduction: Lowering the likelihood or impact of a risk through safeguards and resilience.

Risk transfer: Allocating specified financial or contractual consequences to another party.

Risk sharing: Distributing risk responsibility, capability, or exposure among parties.

Risk acceptance: Deliberately retaining risk within approved authority and tolerance.

Residual risk: Risk remaining after controls and other treatment measures are applied.

Preventive control: A safeguard intended to stop an unwanted event or reduce its probability.

Detective control: A safeguard that identifies events, deviations, or indicators of compromise.

Corrective control: A safeguard that contains, removes, repairs, or restores after an event.

Compensating control: An alternative safeguard used when the preferred control cannot be implemented.

Single-loss expectancy: Estimated loss from one occurrence of a specified risk event.

Annual rate of occurrence: Estimated frequency with which a risk event occurs in one year.

Annualized loss expectancy: Estimated annual loss calculated from single-loss expectancy and annual occurrence rate.

ROSI: A measure comparing risk-reduction benefit with the investment required to achieve it.

Risk appetite: The broad amount and type of risk an organization is willing to pursue or retain.

Control effectiveness: The degree to which a control operates as intended and achieves its objective.

Portfolio prioritization: Ranking investments while considering aggregate exposure, dependencies, and constraints.

Cyber insurance: Financial protection for specified cyber-related losses subject to policy terms and exclusions.

Risk owner: The person accountable for managing and accepting a particular risk.

Review Questions

Short Answer Questions

1. Distinguish risk transfer from risk sharing.

2. Why is risk acceptance not equivalent to ignoring risk?

3. Give two examples of preventive controls and two examples of detective controls.

4. Define residual risk and identify why it should be monitored.

5. State the basic formula for ROSI.

Long Answer Questions

1. Explain the five principal risk treatment strategies and discuss when each may be appropriate.

2. Compare preventive, detective, corrective, and compensating controls using cybersecurity examples.

3. Explain how expected loss, annualized loss expectancy, and cost–benefit analysis support security investment decisions.

4. Discuss the limitations of cyber insurance as a cybersecurity risk treatment.

5. Describe a governance process for documenting and reviewing residual-risk acceptance.

Analytical / Application Questions

1. An organization estimates an annual loss of $900,000 from a ransomware scenario. A control costing $250,000 in the first year and $100,000 annually is expected to reduce the loss by 60 percent. Calculate the first-year net expected benefit and discuss non-financial factors that could affect the decision.

2. A legacy medical device cannot support multifactor authentication. Design a compensating-control package and specify the conditions under which residual risk should be accepted.

3. Two security projects have similar ROSI values, but one protects a single noncritical application while the other strengthens identity services used by the entire organization. Explain how portfolio prioritization should compare them.

22. Multiple Choice Questions with Answers

Question 1

Which treatment strategy changes or stops the activity that creates a specified cyber risk?

A. Risk avoidance

B. Risk transfer

C. Risk sharing

D. Risk acceptance

Correct Answer: A. Risk avoidance

Question 2

A network segmentation control primarily reduces risk by:

A. Guaranteeing that incidents cannot occur

B. Limiting the spread and impact of compromise

C. Transferring liability to an insurer

D. Accepting the existing exposure

Correct Answer: B. Limiting the spread and impact of compromise

Question 3

Which is the best example of a detective control?

A. Multifactor authentication

B. Secure configuration standards

C. Centralized security event monitoring

D. Backup restoration

Correct Answer: C. Centralized security event monitoring

Question 4

A compensating control is most appropriate when:

A. The organization wants to avoid documenting an exception

B. The preferred control cannot be implemented and an alternative can address the risk objective

C. The organization has purchased cyber insurance

D. The risk has already been eliminated

Correct Answer: B. The preferred control cannot be implemented and an alternative can address the risk objective

Question 5

If a single-loss expectancy is $500,000 and the annual rate of occurrence is 0.2, what is the annualized loss expectancy?

A. $100,000

B. $250,000

C. $500,000

D. $2,500,000

Correct Answer: A. $100,000

Question 6

A control provides an estimated annual risk-reduction benefit of $300,000 and costs $200,000 in the relevant period. What is its ROSI?

A. 20 percent

B. 33.3 percent

C. 50 percent

D. 66.7 percent

Correct Answer: C. 50 percent

Question 7

Why does cyber insurance not eliminate the underlying cybersecurity risk?

A. Insurance always prevents technical attacks

B. Insurance transfers every operational and reputational consequence

C. Insurance generally addresses specified financial consequences and remains subject to terms and exclusions

D. Insurance replaces the need for incident response

Correct Answer: C. Insurance generally addresses specified financial consequences and remains subject to terms and exclusions

Question 8

Which information is most important in a residual-risk acceptance record?

A. Only the name of the security product being considered

B. The risk scenario, approving authority, conditions, monitoring, and review date

C. A statement that the risk is probably insignificant

D. The vendor's marketing description

Correct Answer: B. The risk scenario, approving authority, conditions, monitoring, and review date

Question 9

When prioritizing a security portfolio, why should dependencies be considered?

A. A lower-ranked project may enable several other controls or reduce systemic exposure

B. Dependencies make financial analysis unnecessary

C. Dependencies guarantee that all projects have equal value

D. A project with dependencies should always be rejected

Correct Answer: A. A lower-ranked project may enable several other controls or reduce systemic exposure

Question 10

A legacy system cannot support modern authentication. Which response best reflects the chapter's approach?

A. Ignore the limitation because the system is old

B. Immediately accept all related risks permanently

C. Use restricted access, segmentation, monitoring, and a time-limited modernization plan

D. Purchase insurance and remove all technical controls

Correct Answer: C. Use restricted access, segmentation, monitoring, and a time-limited modernization plan