10. Digital Risk, Cybersecurity, Compliance, and Resilience

Introduction and Context

Digital transformation has altered the object, scale, and velocity of organizational risk. Information systems are no longer confined to an identifiable technology department: they support revenue generation, public services, supply chains, clinical decisions, financial transactions, intellectual property, and organizational identity. Consequently, a cyber incident may be simultaneously a technology failure, a privacy violation, a regulatory breach, an operational interruption, a strategic setback, and a crisis of stakeholder confidence.

IT strategic planning must therefore move beyond the narrow question of how to protect infrastructure. It must determine which digital risks the organization is willing to accept, which controls are proportionate, how critical services will continue during disruption, and how the board can obtain credible assurance. This requires integration among enterprise risk management (ERM), cybersecurity, privacy, compliance, business continuity, disaster recovery, third-party oversight, and operational resilience.

The central argument of this chapter is that security is a necessary condition of resilience, but it is not equivalent to resilience. Security seeks to prevent, detect, and contain harmful events. Resilience also asks whether important services can continue, adapt, and recover when prevention fails. Governance connects both perspectives to organizational purpose, accountability, investment, and ethical responsibility.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the relationship between enterprise risk, cyber risk, privacy risk, compliance, continuity, and resilience.

2. Evaluate risk appetite, risk tolerance, inherent risk, residual risk, and control effectiveness.

3. Apply recognized governance and security frameworks to strategic planning.

4. Design an integrated approach to zero trust, third-party risk, privacy, continuity, and disaster recovery.

5. Assess the roles of executives, boards, risk owners, auditors, and technical specialists.

6. Critically evaluate assurance evidence, metrics, emerging technologies, and common weaknesses in digital-risk programs.

7. Recommend ethically and strategically defensible responses to complex digital-risk scenarios.

From Enterprise Risk to Digital Risk

Risk is commonly understood as the effect of uncertainty on objectives. This definition is more useful than treating risk simply as the probability of a bad event, because uncertainty may create either negative or positive effects. In governance practice, however, the focus is usually on threats to strategic, operational, financial, legal, safety, privacy, or reputational objectives.

Enterprise risk management provides the organizing perspective. It links risk identification and treatment to strategy, performance, decision-making, and accountability. Digital risk is not a separate universe of technical events; it is the portion of enterprise risk arising from dependence on data, software, networks, digital identities, technology providers, automated decisions, and digitally mediated processes. A ransomware event, for example, matters because it may stop patient care, delay production, breach confidentiality, or prevent an organization from meeting contractual obligations.

Several distinctions are essential. Inherent risk is the exposure before controls are considered. Residual risk is the exposure remaining after controls and treatments. Risk appetite expresses the broad amount and type of risk an organization is willing to pursue or retain in achieving its objectives. Risk tolerance translates appetite into more specific boundaries, such as maximum service downtime, acceptable financial loss, or permitted data exposure. A risk limit is an operational threshold beyond which escalation or intervention is required.

Risk acceptance is a decision, not an absence of action. It should identify the accountable risk owner, explain why the exposure is tolerable, specify its duration, and record compensating controls. Acceptance by a technical manager is not legitimate when the consequences belong to the board, a customer, a patient, or a regulator.

A Governance Architecture for Digital Risk

Effective governance allocates decision rights and monitors whether decisions are being implemented. The board normally approves strategy, oversees material risks, challenges management assumptions, and satisfies itself that appropriate assurance exists. It need not design firewall rules, but it must understand the organization’s critical services, material cyber exposures, risk appetite, resilience objectives, and evidence of control effectiveness.

Senior management converts governance expectations into policies, funding, structures, and priorities. The chief information officer typically leads technology strategy; the chief information security officer coordinates security risk management; the chief privacy officer or equivalent addresses personal-data obligations; business executives own the risks embedded in their processes; and internal audit provides independent assurance. These roles should collaborate without collapsing their independence. A security function that audits its own controls cannot provide the same assurance as an independent internal-audit review.

A mature governance model separates three related activities:

• Management owns risks and operates controls.
• Risk and compliance functions establish methods, challenge decisions, and monitor exposure.
• Internal and external assurance functions independently evaluate governance, risk management, and controls.

This “three lines” logic is useful but not mechanical. It should not produce excessive committees or duplicate reporting. The proper design depends on organizational size, regulation, complexity, and risk concentration.

Frameworks and Methods: Using Them Without Becoming Framework-Driven

Frameworks provide common language and disciplined practices, but none is a substitute for judgment. The NIST Cybersecurity Framework organizes cybersecurity outcomes around Govern, Identify, Protect, Detect, Respond, and Recover. Its value lies in linking technical activities to organizational outcomes and allowing an organization to describe its current and target states.

The ISO/IEC 27001 family supports an information security management system based on risk assessment, control selection, continual improvement, and documented governance. ISO 31000 offers principles and guidance for risk management, while ISO 22301 addresses business continuity management systems. COBIT contributes governance and management objectives for enterprise information and technology. The CIS Critical Security Controls provide a more operationally focused set of prioritized safeguards.

These approaches are complementary rather than interchangeable. A board may use enterprise-risk principles to set appetite, NIST outcomes to structure cyber capability, ISO 27001 to operate an auditable management system, ISO 22301 to govern continuity, and COBIT to clarify IT decision rights. The danger is “compliance theater”: producing policies, certificates, and dashboards without reducing meaningful exposure. A control should therefore be assessed not only for design but also for operation, coverage, timeliness, and effectiveness under realistic conditions.

A practical risk process usually includes the following sequence:

1. Establish context, objectives, critical services, dependencies, and stakeholders.

2. Identify assets, threats, vulnerabilities, failure modes, legal duties, and plausible scenarios.

3. Analyze likelihood, impact, velocity, persistence, and uncertainty.

4. Evaluate exposure against appetite and tolerance.

5. Select treatments: avoid, reduce, transfer, share, or accept.

6. Assign owners, resources, deadlines, and measurable outcomes.

7. Monitor changes, test controls, report exceptions, and reassess after significant events.

Risk registers are useful coordination devices, but they can create false precision. Numerical scores often conceal assumptions about likelihood and impact. Scenario analysis, sensitivity analysis, threat intelligence, loss data, expert judgment, and stress testing should supplement scoring models.

Cybersecurity as a System of Protection and Adaptation

Cybersecurity protects confidentiality, integrity, and availability, commonly known as the CIA triad. Confidentiality limits unauthorized disclosure; integrity preserves accuracy and trustworthiness; availability ensures timely access to systems and information. Modern programs also emphasize authenticity, accountability, safety, privacy, and resilience.

Controls may be preventive, detective, corrective, deterrent, or compensating. They may be administrative, technical, or physical. Examples include governance policies, secure architecture, multifactor authentication, encryption, segmentation, logging, vulnerability management, staff training, incident response, backups, and physical access controls. Layered defense recognizes that no single control is reliable under all conditions.

Security architecture should begin with business services rather than isolated devices. Dependency mapping identifies applications, data stores, identities, networks, suppliers, facilities, and human roles that support a critical service. This permits more meaningful questions: Which process must be restored first? Which identity provider is a single point of failure? Which supplier can alter production data? Which information may be processed in another jurisdiction?

Incident response should be prepared before an incident. It normally includes preparation; detection and analysis; containment; eradication; recovery; and post-incident learning. Crisis communication, legal advice, evidence preservation, regulator notification, and stakeholder welfare are part of response, not afterthoughts. Paying a ransom, for example, involves legal, ethical, operational, and strategic considerations and does not guarantee deletion of stolen data or restoration of systems.

Zero Trust and Identity-Centered Security

Zero trust is a strategic security model based on the proposition that no user, device, workload, or network location should receive implicit trust. Access is continuously evaluated using identity, device posture, context, resource sensitivity, and policy. Its core ideas include verify explicitly, apply least privilege, and assume breach.

Zero trust does not mean distrusting employees or purchasing a single product. It requires identity governance, strong authentication, authorization policies, endpoint management, segmentation, application-aware controls, logging, and continuous review. Implementation should be risk-based. Critical administrative accounts may require phishing-resistant multifactor authentication, privileged-access management, just-in-time elevation, session recording, and dual authorization. Legacy systems may need compensating controls when modern identity protocols cannot be implemented immediately.

A common failure is to treat zero trust as a perimeter replacement while leaving excessive privileges and poorly governed service accounts untouched. Another is to increase verification so severely that staff create unsafe workarounds. Usability, accessibility, emergency access, and proportionality must therefore be incorporated into design.

Privacy, Compliance, and Responsible Data Governance

Privacy concerns the appropriate collection, use, disclosure, retention, and disposal of information about identifiable individuals. Security protects information from harmful events, whereas privacy also asks whether processing is justified, transparent, proportionate, and consistent with legitimate expectations. An organization can have strong cybersecurity and still violate privacy by collecting excessive data or using it for an undisclosed purpose.

Compliance obligations arise from legislation, regulation, contracts, industry standards, licenses, and internal commitments. Requirements may address breach notification, records retention, financial controls, critical infrastructure, health information, employment data, consumer protection, or cross-border transfers. Organizations should maintain a requirements inventory mapping each obligation to accountable owners, controls, evidence, and review dates.

Privacy by design integrates privacy considerations into architecture and product development rather than adding them after deployment. Relevant practices include data minimization, purpose limitation, retention schedules, access transparency, privacy impact assessments, pseudonymization, encryption, individual rights processes, and controlled use of analytics. Automated decision systems may require explanation, human review, bias testing, and appeal mechanisms.

Compliance should not be confused with ethical adequacy. A practice may be lawful but unfair, manipulative, discriminatory, or harmful to vulnerable groups. Professional judgment requires attention to affected communities, power asymmetries, accessibility, surveillance risks, and the possibility that data-driven systems reproduce historical bias.

Continuity, Disaster Recovery, and Operational Resilience

Business continuity focuses on maintaining or restoring prioritized activities after disruption. Disaster recovery is the technology-centered component concerned with restoring systems, data, infrastructure, and services. Operational resilience is broader: it concerns the capability to prevent, absorb, adapt to, recover from, and learn through disruption while continuing important business services.

Business impact analysis identifies important activities, dependencies, maximum tolerable disruption, recovery time objectives (RTOs), and recovery point objectives (RPOs). RTO states the targeted time to restore a service; RPO states the acceptable age of restored data. These targets must be economically and operationally credible. A one-hour RTO cannot be achieved merely by writing it into a policy if restoration procedures, staffing, suppliers, and architecture cannot support it.

Continuity strategies include redundancy, alternate facilities, manual workarounds, replication, immutable backups, geographic diversification, mutual assistance, and prearranged supplier support. Backups should be protected from unauthorized alteration and tested through restoration. A backup that has never been restored is an assumption, not assurance.

Resilience testing should include tabletop exercises, technical recovery tests, communications exercises, failover tests, red-team activities, and scenario-based stress tests. Testing should examine degraded operation, conflicting priorities, unavailable suppliers, misinformation, staff fatigue, and simultaneous failures. The purpose is not to create a flawless demonstration but to reveal dependencies and improve adaptive capacity.

Third-Party and Supply-Chain Risk

Organizations increasingly depend on cloud providers, software vendors, managed-service firms, payment processors, consultants, open-source components, and critical infrastructure partners. Outsourcing a function does not outsource accountability. Third-party risk management should begin with classification according to criticality, data sensitivity, concentration, substitutability, jurisdiction, and systemic importance.

Due diligence may examine security architecture, independent assurance reports, incident history, resilience testing, subcontractors, data location, personnel practices, financial viability, and exit capability. Contracts should address security requirements, audit and assurance rights, breach notification, data return and deletion, business continuity, service levels, access controls, vulnerability disclosure, subcontracting, and termination assistance.

Continuous monitoring is necessary because a favorable assessment at onboarding does not guarantee future performance. Organizations should avoid relying exclusively on vendor questionnaires. Evidence may include technical tests, independent reports, performance data, threat intelligence, incident disclosures, and exercised exit plans. Concentration risk deserves special attention: multiple services may depend on the same cloud region, identity provider, telecommunications carrier, or software library.

Assurance, Metrics, and Board Oversight

Assurance is credible when it is relevant, independent enough for its purpose, based on reliable evidence, and communicated in a form decision-makers can use. Certifications demonstrate that a management system or control environment was assessed against a defined standard; they do not prove that every system is secure or that future performance is guaranteed.

Useful board reporting emphasizes exposure and decisions rather than technical volume. Measures may include the percentage of critical services with tested recovery plans, privileged accounts protected by strong authentication, critical vulnerabilities exceeding remediation targets, mean time to contain incidents, restoration-test success rates, material supplier coverage, unresolved audit findings, and the age and business impact of accepted risks. Metrics should be segmented by critical service and trend over time.

A high number of blocked attacks may indicate strong defense, intense targeting, or poor measurement. A low incident count may indicate low exposure—or weak detection. Metrics must therefore be interpreted with context, confidence levels, limitations, and possible gaming behavior. Boards should ask: What assumptions underlie this measure? Which critical dependencies are outside management control? What would cause the risk to exceed appetite? When was the last realistic test? Who accepts the remaining exposure?

Illustrative Case: The Resilience Failure of Northstar Health Network

Background

Northstar Health Network is an illustrative regional healthcare organization operating hospitals, outpatient clinics, laboratories, and a patient portal. Its clinical information system is hosted by a cloud service provider, while identity management, laboratory reporting, payment processing, and medical-device maintenance are supplied by separate third parties. The board had approved a low tolerance for interruption of emergency and inpatient services.

Situation and Problem

A compromised vendor credential was used to access Northstar’s remote-support environment. Attackers moved laterally, encrypted shared systems, and exfiltrated patient records. The organization possessed written incident and disaster-recovery plans, but its clinical system and identity service depended on the same cloud region. Backups existed, yet several were reachable through production credentials and had not been restored in a full-scale exercise. The vendor contract required notification of security incidents but did not specify a sufficiently rapid reporting window or effective audit rights.

Analysis

The immediate event was a credential compromise, but the material risk resulted from interacting weaknesses: excessive vendor privilege, inadequate segmentation, concentration of technology dependencies, weak backup isolation, incomplete third-party assurance, and an unrealistic recovery target. The risk register had classified “cyberattack” as a high-level threat but had not modeled the failure of emergency care as a business-service scenario. The board received counts of blocked attacks and overdue patches, but not evidence about clinical-service recoverability.

Approach and Strategy

Northstar established a clinical-service resilience program led jointly by clinical, technology, risk, privacy, and continuity executives. It first mapped dependencies for emergency, inpatient, laboratory, and pharmacy services. It then introduced phishing-resistant authentication for privileged and vendor accounts, just-in-time access, session monitoring, network segmentation, and formal vendor access approval. Backups were separated from production credentials, replicated to an independent environment, and tested through staged restoration.

The organization revised supplier contracts to require rapid incident notification, cooperation with forensics, evidence preservation, subcontractor transparency, and tested continuity capabilities. It conducted a tabletop exercise involving clinical leaders, legal counsel, communications staff, regulators, and the cloud provider, followed by a technical recovery exercise. The board changed its dashboard to show service-based RTO performance, unresolved high-risk exceptions, dependency concentration, and the status of resilience tests.

Outcome

The program did not eliminate cyber risk. It reduced the likelihood that a compromised vendor account could reach critical systems, improved detection and containment, and increased confidence that essential clinical functions could continue in degraded mode. The exercise also revealed a previously unrecognized dependence on a telecommunications provider, which was subsequently addressed. Northstar’s principal improvement was not the acquisition of a particular security product; it was the integration of risk ownership, service mapping, technical controls, supplier governance, and board-level assurance.

Learning Points

The case demonstrates that a security incident becomes a resilience crisis through dependency relationships. It also shows why risk statements should be expressed in business terms, why recovery claims must be tested, and why third-party governance must extend beyond procurement. Finally, compliance evidence is valuable only when it illuminates actual capability and supports timely decisions.

Persistent Challenges and Common Errors

Digital-risk programs face several recurring difficulties. First, organizations often optimize for visible compliance rather than reduced exposure. Second, responsibility becomes fragmented among technology, legal, privacy, procurement, and business units. Third, risk registers become static documents even though cloud configurations, threats, suppliers, and regulations change continuously. Fourth, organizations underinvest in identity, asset inventories, logging, recovery engineering, and workforce capability because these activities are less visible than new platforms.

Other errors include treating vulnerability counts as risk, assuming insurance transfers accountability, failing to include executives in exercises, neglecting small suppliers, retaining excessive data, and accepting risks without expiry dates. Excessive centralization can also be harmful: a single security team may become a bottleneck, while business units fail to own the consequences of their decisions.

Research and practice also debate how much risk can be quantified. Financial models can improve comparison, but cyber events are dependent, adaptive, and historically sparse. Quantification should therefore expose assumptions and support decisions, not create an illusion of actuarial certainty. Qualitative judgment remains necessary, particularly for safety, human rights, systemic effects, and low-frequency catastrophic scenarios.

Emerging Directions

Artificial intelligence is affecting both attack and defense. It can accelerate phishing, social engineering, code generation, vulnerability discovery, and disinformation. It can also support anomaly detection, security-operations triage, malware analysis, control testing, and recovery planning. The use of AI introduces additional concerns involving data provenance, model manipulation, confidentiality, explainability, bias, hallucination, and accountability. Human oversight and controlled experimentation are essential for high-impact decisions.

Other developments include software supply-chain security, software bills of materials, confidential computing, post-quantum cryptography planning, cyber-physical convergence, regulatory emphasis on executive accountability, and resilience expectations for critical digital services. Organizations should avoid treating emerging technologies as isolated trends. Their significance depends on how they alter dependencies, attack surfaces, skills, controls, and stakeholder expectations.

Best-Practice Principles for Strategic Planning

A defensible digital-risk strategy should:

• begin with critical services, organizational objectives, and stakeholder harm;
• define appetite, tolerance, ownership, escalation, and acceptance authority;
• maintain accurate inventories of assets, data, identities, suppliers, and dependencies;
• apply layered security and identity-centered access controls;
• integrate privacy, safety, ethics, and legal requirements into system design;
• protect and regularly restore backups and exercise continuity plans;
• classify and continuously monitor third parties and concentration risks;
• report meaningful, contextualized measures rather than technical activity alone;
• preserve independent assurance and challenge management assumptions; and
• treat incidents, tests, and near misses as sources of organizational learning.

These principles do not remove uncertainty. They create a governance capability through which uncertainty can be recognized, discussed, prioritized, and managed.

Chapter Summary

Digital risk is enterprise risk arising from dependence on information, technology, digital identities, software, suppliers, and automated processes. Effective governance connects risk appetite and ownership with cybersecurity, privacy, compliance, continuity, disaster recovery, and operational resilience. Frameworks such as NIST, ISO/IEC 27001, ISO 31000, ISO 22301, COBIT, and the CIS Controls provide useful structures, but they must be adapted to organizational objectives and tested against real service scenarios.

Security controls protect confidentiality, integrity, and availability, while resilience ensures that important services can continue and recover when controls fail. Zero trust emphasizes explicit verification and least privilege; privacy requires lawful, proportionate, and ethical data use; third-party governance must address concentration and exit capability; and assurance must rely on credible evidence. Board oversight is strongest when reporting expresses risk in terms of critical services, stakeholder consequences, recovery capability, and decisions required. Emerging technologies, especially AI, create both new defensive opportunities and new governance obligations.

Key Terms

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Risk tolerance: A more specific boundary defining acceptable variation or exposure.

Inherent risk: Exposure before controls or treatments are applied.

Residual risk: Exposure remaining after controls and treatments.

Enterprise risk management: Coordinated management of risks in relation to strategy and objectives.

Cybersecurity: Protection of digital systems, data, identities, and services from harmful or unauthorized activity.

Operational resilience: The capability to continue, adapt, recover, and learn through disruption.

Business continuity: The capability to maintain or restore prioritized activities after disruption.

Disaster recovery: Restoration of technology, systems, infrastructure, and data after disruption.

Zero trust: A security approach that grants no implicit trust and continually evaluates access.

Least privilege: Restricting access to the minimum necessary for an authorized task.

Privacy by design: Embedding privacy safeguards throughout system and process design.

Third-party risk: Exposure arising from suppliers, partners, contractors, and service providers.

Recovery time objective: The targeted time within which a service or system should be restored.

Recovery point objective: The maximum acceptable age of data available after recovery.

Control effectiveness: The extent to which a control is appropriately designed and operates as intended.

Assurance: Evidence-based confidence that governance, risk, and controls are appropriate and effective.

Risk acceptance: An explicit decision by an authorized owner to retain a specified exposure.

Critical service: A service whose disruption would materially affect important organizational objectives or stakeholders.

Compliance theater: Activities that demonstrate formal conformity without meaningfully reducing risk.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk.

2. Why is cybersecurity necessary but insufficient for operational resilience?

3. What do RTO and RPO measure?

4. Explain the principle of least privilege in a zero-trust architecture.

5. Why does outsourcing a service not outsource accountability?

Long Answer Questions

1. Explain how enterprise risk management can integrate cybersecurity, privacy, compliance, continuity, and third-party risk.

2. Compare the purposes and contributions of the NIST Cybersecurity Framework, ISO/IEC 27001, ISO 22301, and COBIT.

3. Discuss the responsibilities of the board, senior management, risk functions, technical teams, and internal audit in digital-risk governance.

4. Analyze why compliance certification cannot by itself demonstrate operational resilience.

5. Describe how a business impact analysis should inform continuity and disaster-recovery investment.

Analytical / Application Questions

1. A university’s cloud identity provider, learning platform, and research environment share one authentication service. Analyze the concentration risks and recommend a resilience strategy.

2. A board dashboard reports declining vulnerability counts but increasing recovery-test failures. Interpret this evidence and propose questions the board should ask management.

3. A healthcare supplier requests permanent administrator access to production systems. Evaluate the request using zero-trust, privacy, third-party-risk, and operational-resilience principles.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes operational resilience from cybersecurity?

A. Operational resilience focuses only on preventing unauthorized access.

B. Operational resilience includes continuing and recovering important services when preventive controls fail.

C. Operational resilience replaces the need for incident response.

D. Operational resilience is limited to financial risk management.

Correct Answer: B. Operational resilience includes continuing and recovering important services when preventive controls fail.

Question 2

A risk owner approves continued exposure without documenting duration, rationale, or compensating controls. What is the principal governance weakness?

A. The risk has been transferred to the auditor.

B. The decision is not an adequately governed risk acceptance.

C. The inherent risk has been eliminated.

D. The control has automatically become detective.

Correct Answer: B. The decision is not an adequately governed risk acceptance.

Question 3

Which practice most directly reflects zero-trust principles?

A. Allowing internal network users broad access based on location.

B. Granting permanent administrator rights to trusted suppliers.

C. Evaluating identity, device posture, context, and resource sensitivity before access.

D. Replacing all authentication with a perimeter firewall.

Correct Answer: C. Evaluating identity, device posture, context, and resource sensitivity before access.

Question 4

What is the most accurate interpretation of an RPO?

A. The maximum acceptable time before a service is restored.

B. The maximum acceptable age of data available after recovery.

C. The number of recovery staff required for a critical service.

D. The time required to notify a regulator.

Correct Answer: B. The maximum acceptable age of data available after recovery.

Question 5

A company has passed an information-security certification audit but has never restored its backups. What conclusion is most defensible?

A. The company has proved that its services are resilient.

B. Certification guarantees that recovery will meet the stated RTO.

C. The company has some assurance about the assessed system, but recovery capability remains unverified.

D. Backup restoration is irrelevant if preventive controls exist.

Correct Answer: C. The company has some assurance about the assessed system, but recovery capability remains unverified.

Question 6

Which board metric is most closely aligned with service resilience?

A. Number of firewall rules created this quarter.

B. Number of phishing emails blocked without contextual analysis.

C. Percentage of critical services whose recovery plans have been successfully tested.

D. Total number of security-policy pages.

Correct Answer: C. Percentage of critical services whose recovery plans have been successfully tested.

Question 7

Why is privacy broader than information security?

A. Privacy applies only to encrypted information.

B. Privacy examines whether collection and use are justified, proportionate, and transparent, as well as protected.

C. Privacy eliminates the need for access controls.

D. Privacy is concerned only with data storage location.

Correct Answer: B. Privacy examines whether collection and use are justified, proportionate, and transparent, as well as protected.

Question 8

Northstar’s principal resilience weakness in the case was best characterized as:

A. A lack of any written security policy.

B. A single technical vulnerability unrelated to business operations.

C. Interacting weaknesses involving vendor access, dependency concentration, backups, and untested recovery.

D. An excessive number of independent recovery environments.

Correct Answer: C. Interacting weaknesses involving vendor access, dependency concentration, backups, and untested recovery.

Question 9

Which third-party practice most effectively addresses concentration risk?

A. Using one provider for all critical services to simplify procurement.

B. Reviewing only the supplier’s marketing materials.

C. Mapping shared dependencies and assessing substitutability, geographic concentration, and exit capability.

D. Accepting the supplier’s questionnaire without validation.

Correct Answer: C. Mapping shared dependencies and assessing substitutability, geographic concentration, and exit capability.

Question 10

Why should cyber-risk metrics be interpreted cautiously?

A. All cyber events are impossible to measure.

B. Metrics such as blocked attacks or vulnerability counts may not represent actual exposure or recovery capability.

C. Boards should receive only technical logs.

D. Quantitative information is never useful in governance.

Correct Answer: B. Metrics such as blocked attacks or vulnerability counts may not represent actual exposure or recovery capability.