Cyber-Risk Management, Governance and Strategic Decision-Making

Introduction

Cybersecurity has become an enterprise-governance concern rather than a narrowly technical function. A successful cyberattack can interrupt operations, expose personal data, create regulatory liability, damage reputation, reduce market value and undermine public confidence. Consequently, information-technology leaders must make decisions under uncertainty: which risks deserve treatment, how much should be invested, which controls are proportionate, and how should residual risk be presented to executives and the board?

Cyber-risk management provides the discipline for answering these questions. It connects business objectives, information assets, threats, vulnerabilities, controls, legal obligations and financial consequences. Governance supplies authority and accountability, while strategic decision-making determines priorities over time. This chapter integrates the NIST Cybersecurity Framework (CSF), ISO/IEC 27001, the CIS Critical Security Controls, qualitative and quantitative risk assessment, security economics, third-party risk, privacy, compliance, cyber insurance, audit and executive reporting.

The purpose is not to make risk disappear. Risk is inherent in digital business. The purpose is to identify material uncertainty, reduce exposure to an acceptable level, allocate resources rationally and ensure that remaining risk is consciously accepted by an appropriately authorized decision-maker.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain cyber-risk governance and distinguish it from operational security management.
2. Compare the NIST CSF, ISO/IEC 27001 and CIS Controls.
3. Conduct qualitative and quantitative cyber-risk assessments.
4. Select controls using risk, cost, feasibility and assurance considerations.
5. Apply security-economics concepts to budgeting and investment decisions.
6. Evaluate vendor, supply-chain, privacy, compliance and insurance risk.
7. Design meaningful executive and board-level cyber-risk reporting.
8. Critically assess the limitations and ethical implications of cyber-risk decisions.

1. Cyber Risk as an Enterprise Decision Problem

Risk is commonly understood as the effect of uncertainty on objectives. In cybersecurity, the uncertainty may concern whether an attacker will succeed, how long a compromise will remain undetected, or what financial and legal consequences will follow. A useful decomposition is:

• Asset or business process: what creates value or enables operations.
• Threat: an event or actor capable of causing harm.
• Vulnerability: a weakness that can be exploited.
• Control: a safeguard that reduces likelihood, impact or uncertainty.
• Consequence: the resulting operational, financial, legal, safety or reputational effect.
• Residual risk: risk remaining after controls are applied.

Security risk differs from ordinary project risk because adversaries adapt strategically. A control may change attacker behaviour rather than simply reduce a measurable probability. Moreover, dependencies create correlated failures: one cloud provider, identity service or software library may support many business processes simultaneously.

Risk ownership should normally reside with the business executive accountable for the affected objective. The chief information security officer (CISO) advises, coordinates and monitors, but should not become the sole owner of risks created by business decisions. For example, the executive responsible for online revenue should own the decision to tolerate a short service interruption, while the CISO evaluates the threat and recommends safeguards.

Risk treatment choices

Four standard responses are:

1. Avoid: discontinue the activity creating unacceptable exposure.
2. Reduce or mitigate: implement controls that lower likelihood or impact.
3. Transfer or share: use contracts, outsourcing or insurance to transfer some financial consequences. Responsibility for security is rarely transferred completely.
4. Accept: consciously retain the risk within approved tolerance.

Risk acceptance must be explicit, time-bounded where appropriate and approved by a person with sufficient authority. Silence is not a valid risk-acceptance decision.

2. Governance, Management and Accountability

Governance determines direction, establishes accountability and evaluates whether objectives are achieved. Management plans and operates within that direction. In a cyber context, governance includes:

• defining risk appetite and tolerance;
• approving security strategy and funding;
• assigning risk ownership;
• ensuring legal, regulatory and contractual compliance;
• monitoring performance and emerging threats;
• overseeing independent assurance;
• requiring timely escalation of material risk.

A board should not attempt to manage firewall rules or vulnerability tickets. It should, however, ask whether critical services are identified, whether material weaknesses have owners and deadlines, whether recovery capabilities have been tested, and whether management understands its dependence on suppliers.

A practical accountability structure uses three lines:

• First line: business and technology teams own and manage risks in daily operations.
• Second line: risk, compliance and security functions establish methods, challenge decisions and monitor adherence.
• Third line: internal audit provides independent assurance to the board or audit committee.

The model is not a substitute for clear responsibility. Security teams cannot compensate for business owners who do not maintain inventories, approve access or fund remediation.

3. Major Cybersecurity Frameworks

3.1 NIST Cybersecurity Framework

The NIST CSF provides a flexible vocabulary and outcome-oriented structure. Its widely used functions are:

• Govern: establish organizational context, strategy, policy, roles, oversight and supply-chain expectations.
• Identify: understand assets, business environment, risks and improvement opportunities.
• Protect: implement safeguards for identity, access, data, platforms, awareness and resilience.
• Detect: discover and analyse anomalous events and indicators of compromise.
• Respond: manage incidents, communicate, analyse and mitigate.
• Recover: restore capabilities, communicate recovery and incorporate lessons learned.

Organizations may define a current profile, a target profile and prioritized gaps. The framework is deliberately technology-neutral; it does not prescribe a particular product or security architecture.

3.2 ISO/IEC 27001

ISO/IEC 27001 specifies requirements for an information security management system (ISMS). Its emphasis is management-system discipline: context, leadership, planning, support, operation, performance evaluation and continual improvement. A risk assessment determines applicable controls, which are documented through the organization’s statement of applicability. Certification provides independent conformity assessment against the standard, but it is not proof that an organization is immune from attack.

ISO/IEC 27001 is valuable where repeatable governance, documented processes, evidence and continual improvement are important. Its limitation is that conformity can become a paperwork exercise if leadership focuses on audit completion rather than actual risk reduction.

3.3 CIS Critical Security Controls

The CIS Controls provide prioritized, practical safeguards such as asset inventory, software inventory, data protection, secure configuration, account management, vulnerability management, audit logging, malware defenses, incident response and penetration testing. They are particularly useful for implementation road maps and operational prioritization. Their prescriptive nature can accelerate improvement, although organizations must still adapt them to sector, architecture, risk appetite and legal obligations.

3.4 Complementarity

These frameworks should not be treated as competitors. A useful integration is:

A mature program maps controls and evidence across frameworks rather than creating separate, conflicting programs.

4. Risk Assessment Methods

4.1 Assessment process

A defensible assessment generally follows these stages:

1. Define scope, assumptions, time horizon and risk criteria.
2. Identify critical services, assets, data and dependencies.
3. Identify relevant threat scenarios and vulnerabilities.
4. Estimate likelihood and consequences.
5. Evaluate existing controls and their effectiveness.
6. Determine inherent and residual risk.
7. Select treatment options and owners.
8. Record decisions, assumptions and review dates.

A scenario is more useful than a vague statement such as “ransomware risk.” A scenario might be: “An attacker obtains privileged credentials through phishing, encrypts the production file service and disrupts order fulfilment for two days.” The scenario supports concrete analysis of controls, consequences and recovery.

4.2 Qualitative analysis

Qualitative assessment uses categories such as low, moderate and high. A simple risk matrix may combine likelihood and impact, but the scales must be defined. “High likelihood” could mean more than once per year in one organization and more than once per month in another.

Qualitative analysis is appropriate when data are sparse, decisions are urgent or results must be communicated quickly. It is vulnerable to anchoring, inconsistent judgments and false precision caused by arbitrary scores. Workshops should record reasoning, evidence and disagreement rather than only a final colour.

4.3 Quantitative analysis

A basic single-loss-expectancy model is:

where ALE is annualized loss expectancy, measured in currency per year; SLE is single-loss expectancy, the financial loss from one event; and ARO is annual rate of occurrence, measured in events per year. The model assumes that the estimated frequency and loss are sufficiently meaningful for the decision and that the events being modelled are reasonably comparable.

If an outage is estimated to cost $180,000 per incident and occurs 0.4 times per year, then:

If a proposed control costs $30,000 annually and is expected to reduce the ALE to $25,000, the expected annual benefit is $47,000. A simple net annual benefit is:

Thus, the net benefit is $47,000 − $30,000 = $17,000 per year, before considering implementation cost, secondary benefits, uncertainty and interactions with other controls.

A return-on-security-investment indicator may be expressed as:

For the example, ROSI = $17,000 ÷ $30,000 ≈ 0.567, or 56.7%. This is not a guaranteed financial return. It is an estimate conditional on assumptions about frequency, impact and control effectiveness.

For multiple independent event categories, expected annual loss can be approximated by:

where pᵢ is the annual probability of event category i and Iᵢ is its monetary impact. Independence should not be assumed when events share a common provider, identity system or infrastructure. Correlation can make aggregate loss much greater than a simple sum suggests.

Quantitative analysis can use ranges or probability distributions rather than point estimates. Monte Carlo simulation repeatedly samples uncertain frequencies and impacts to produce a distribution of possible annual losses. The result may include a mean, percentile or tail measure. Such outputs are useful only when the input assumptions are credible; sophisticated simulation does not remove poor data.

4.4 Expected value and uncertainty

The expected value of loss is not the same as a forecast of the actual outcome. A rare event may have a low annual expected value but catastrophic consequences. Boards may therefore impose separate limits for maximum tolerable downtime, safety impact, privacy harm or concentration risk. Risk decisions should combine expected financial loss with scenario severity, uncertainty and organizational values.

5. Control Selection and Assurance

Controls should be selected according to the risk scenario and business requirement, not because a product is fashionable. A control may be preventive, detective, corrective, deterrent or compensating. It may be administrative, technical or physical.

Effective control selection considers:

• risk reduction and threat relevance;
• coverage of critical assets and identities;
• implementation and operating cost;
• usability and effects on productivity;
• resilience if the control itself fails;
• maintainability and integration;
• evidence and auditability;
• privacy and proportionality;
• dependence on vendors;
• residual risk after implementation.

Controls operate as systems. Multifactor authentication is weakened by help-desk bypass procedures; encryption is weakened by poor key management; backups are weakened if they are reachable by ransomware; logging is weakened if nobody monitors or retains logs. Control design must therefore examine dependencies and failure modes.

Assurance asks whether a control exists, is suitably designed and operates effectively over time. Evidence may include configuration records, access reviews, incident exercises, vulnerability reports, supplier attestations and independent testing. A policy document alone is weak evidence of operating effectiveness.

6. Security Economics and Budgeting

Cybersecurity budgeting is a portfolio decision. Spending should be linked to business services and risk reduction rather than to an undifferentiated percentage of IT expenditure. A budget proposal should state the risk addressed, affected assets, expected benefit, implementation dependencies, recurring cost, residual risk and measures of success.

Costs include more than acquisition price. Total cost of ownership may include licensing, implementation, integration, training, staffing, maintenance, downtime during deployment, audit and exit costs. Benefits may include avoided loss, reduced recovery time, improved compliance, customer confidence and greater operational reliability.

A control with positive expected financial value may still be rejected if it creates unacceptable privacy intrusion, operational fragility or strategic dependence. Conversely, a control with negative narrow ROSI may be required by law or necessary to preserve safety and trust.

Budgeting should distinguish:

• Run costs: operating and maintaining existing capability.
• Change costs: projects that improve or transform capability.
• Capability debt: deferred work that increases future cost and exposure.
• Contingency: resources reserved for emerging threats and incidents.

Scenario analysis is often more credible than a single return figure. Management can present optimistic, central and pessimistic assumptions, showing how the recommendation changes under each case.

7. Vendor and Supply-Chain Risk

Modern organizations depend on cloud services, managed security providers, software libraries, hardware manufacturers, consultants and logistics partners. A supplier may have privileged access, process sensitive data or create a concentration risk affecting many customers.

A supplier-risk program should:

1. classify suppliers by criticality, data access and operational dependency;
2. perform due diligence before contracting;
3. define security, privacy, resilience and incident-notification requirements;
4. require appropriate evidence and audit rights;
5. monitor changes, vulnerabilities, subcontractors and financial health;
6. test exit, portability and continuity arrangements;
7. reassess suppliers throughout the relationship.

Contracts should identify responsibilities rather than relying on the phrase “industry-standard security.” Important provisions may address access control, encryption, secure development, vulnerability notification, breach cooperation, data location, retention and deletion, audit evidence, business continuity, subcontracting and termination assistance.

Third-party assurance reports are useful but limited. They may cover only a defined period, scope and control set. A clean report does not prove that the service meets the customer’s specific risk requirements. Supply-chain security also includes software provenance, dependency management, code signing, build integrity and vulnerability disclosure.

8. Privacy, Compliance and Ethical Governance

Security and privacy overlap but are not identical. Security protects confidentiality, integrity and availability; privacy concerns the justified collection, use, disclosure, retention and rights associated with personal information. A security control can create privacy risk if it collects excessive employee or customer data.

Privacy-by-design principles include purpose limitation, data minimization, access control, retention limits, transparency and accountability. Risk assessments should consider harms such as discrimination, identity theft, embarrassment, surveillance and loss of autonomy, not merely regulatory fines.

Compliance requirements arise from legislation, regulation, contracts, industry standards and internal policy. Compliance is a floor, not a complete security strategy. An organization may comply with a specified requirement while remaining vulnerable to a new attack path. Conversely, a risk-based control may exceed minimum legal requirements because the organization’s exposure or ethical obligations warrant it.

Ethical governance requires proportionality, fairness and accountability. Organizations should not use cyber-risk models to justify intrusive monitoring without considering employee rights or discriminatory effects. Automated risk scoring should be explainable enough for affected decision-makers to challenge errors. Confidential vulnerability information must be protected, but secrecy should not be used to conceal negligence from regulators, customers or boards.

9. Cyber Insurance

Cyber insurance may cover selected costs such as incident response, legal advice, notification, restoration, business interruption or liability. It does not eliminate operational, reputational or ethical consequences. Policies contain exclusions, sublimits, waiting periods, warranties and conditions concerning minimum controls.

Before purchasing insurance, an organization should understand:

• covered and excluded events;
• whether dependent business interruption is covered;
• requirements for approved vendors;
• notification and cooperation duties;
• treatment of prior known vulnerabilities;
• ransomware payment restrictions and legal constraints;
• aggregation and systemic-event limits.

Insurance can create moral hazard if organizations reduce prevention because losses are partly insured. Underwriting questionnaires may also encourage better control maturity, but organizations must ensure that representations are accurate. Insurance should complement, not replace, resilience and risk reduction.

10. Audit, Metrics and Executive Reporting

Effective reporting converts technical conditions into decisions. A board dashboard should emphasize trends, exposure and action rather than overwhelming recipients with ticket counts. Useful measures include:

• percentage of critical assets with accountable owners;
• privileged accounts protected by phishing-resistant multifactor authentication;
• critical vulnerabilities exceeding approved remediation time;
• mean time to detect and contain significant incidents;
• tested recovery time and recovery-point performance;
• high-risk suppliers with current assessments;
• control exceptions by age and business owner;
• material incidents and lessons learned;
• progress against target risk profile.

Metrics should have definitions, data sources, scope, frequency and thresholds. A falling incident count is not automatically good: it may reflect under-reporting or reduced detection. Metrics should distinguish activity, capability and outcome. “Number of awareness modules completed” is an activity measure; “reduction in successful credential-phishing events” is closer to an outcome.

A strong executive report answers five questions:

1. What business services matter most?
2. What has changed in the threat or exposure?
3. Which risks exceed tolerance?
4. What decision or funding is required?
5. Who owns the action and when will it be verified?

Audit findings should be prioritized by business impact, likelihood, control failure and management response. Repeated findings indicate governance failure rather than isolated technical defects.

11. Strategic Decision-Making Under Uncertainty

Strategic cyber decisions often involve incomplete information and competing objectives. A useful decision process combines scenario planning, sensitivity analysis and staged investment. Management may first fund low-regret controls—such as reliable asset inventory, strong identity protection and tested backups—then invest further as evidence improves.

Real-options thinking is useful when postponing a decision preserves flexibility but exposes the organization to growing risk. For example, a phased migration may allow learning before a full commitment, but delay can also increase dependency and remediation cost. The decision should explicitly compare the value of information against the cost of delay.

Risk appetite should be expressed in operational terms. “Low cyber risk” is not actionable. Better statements include: no more than four hours of loss of access to a critical clinical system; no unencrypted storage of specified personal data; or no critical supplier without tested continuity arrangements.

Artificial intelligence can assist with anomaly detection, asset discovery, prioritization and scenario analysis. However, AI outputs may be biased, opaque or vulnerable to manipulation. Governance should define data provenance, human review, model performance, false-positive costs, privacy safeguards and accountability for automated decisions. AI is a decision-support capability, not a substitute for risk ownership.

12. Illustrative Case: Northbridge Retail Group

Background

Northbridge Retail Group is a fictional regional retailer operating physical stores, an e-commerce platform and a loyalty program. It uses a cloud-based payment service, a warehouse-management provider and several software-as-a-service applications. The board has asked management to reduce the likelihood and impact of a major cyber incident without materially delaying a planned digital expansion.

Problem

The initial assessment shows incomplete asset ownership, inconsistent multifactor authentication, untested recovery procedures and limited visibility into suppliers. A qualitative workshop rates ransomware as “high,” but the board wants a defensible investment recommendation.

Analysis

The security team defines a scenario: compromise of a privileged identity leads to encryption of warehouse and order-processing systems. Historical internal data and external benchmarks suggest an annual occurrence rate between 0.15 and 0.35. Estimated direct and indirect loss ranges from $0.8 million to $3 million, depending on outage duration and seasonal demand. These estimates are uncertain and exclude difficult-to-measure reputation effects.

Management evaluates three treatment packages:

The analysis does not select a package solely by comparing cost with one expected-loss number. It examines peak-season downtime, supplier dependencies, recovery tests, implementation capacity and legal obligations for loyalty data. Package A is treated as a minimum risk-reduction baseline. Package B is recommended for the next budget cycle because the e-commerce and warehouse services are highly time-sensitive. Package C is staged over two years because supplier transformation requires contract renewal and architectural changes.

Approach and solution

Northbridge establishes a NIST CSF target profile, maps existing controls to CIS priorities and uses its ISMS risk register to assign owners. The board approves explicit tolerance: the order platform must be recoverable within eight hours, and critical privileged accounts must use phishing-resistant multifactor authentication. Supplier contracts are revised to require incident cooperation, recovery evidence and timely vulnerability notification.

The organization conducts a restore exercise rather than merely checking whether backups exist. It also creates a quarterly dashboard showing privileged-account coverage, critical vulnerability age, recovery-test performance, supplier assessment status and risk exceptions.

Outcome

After six months, all critical administrative accounts use stronger authentication, immutable backups cover priority systems and a recovery exercise identifies a previously unknown dependency on a warehouse integration. The exercise produces a remediation action before a real incident occurs. The board does not conclude that ransomware risk is eliminated; it concludes that residual risk is visible, owned and within the newly approved tolerance, subject to continued monitoring.

Learning points

The case illustrates five principles: scenario definition is better than vague risk labels; controls must be tested in operational conditions; supplier dependencies can invalidate recovery assumptions; investment should be staged according to criticality and capacity; and board governance requires decisions, owners and tolerance—not merely technical statistics.

Challenges and Limitations

Cyber-risk analysis has inherent limitations. Threat data may be incomplete, impacts may be difficult to monetize and controls may interact in non-linear ways. Attackers change tactics, while historical frequency may not represent future conditions. Risk matrices can conceal uncertainty behind colours, and quantitative models can create false confidence when estimates are subjective.

Frameworks also have limitations. They provide structure but cannot determine risk appetite, guarantee implementation or replace professional judgment. Certification can encourage evidence production without meaningful resilience. Metrics can be gamed, and benchmarking can reward conformity rather than improvement. Finally, security decisions can distribute harm unevenly: a control that protects an organization may impose surveillance or exclusion on individuals.

These limitations do not justify abandoning analysis. They require transparent assumptions, independent challenge, scenario testing, sensitivity analysis, continuous review and clear communication of uncertainty.

Best-Practice Checklist

A mature cyber-risk governance program should:

• link cyber risks to critical business services;
• assign accountable owners and approval authority;
• maintain current asset, data and dependency inventories;
• use a common framework and a traceable control map;
• combine qualitative judgment with quantitative analysis where useful;
• document assumptions, uncertainty and residual risk;
• prioritize identity, vulnerability, recovery and supplier fundamentals;
• test controls and recovery rather than relying on policy statements;
• integrate privacy, legal, safety and ethical review;
• report trends, tolerance breaches and decisions to executives;
• review insurance and contracts as part of, not instead of, resilience;
• learn from incidents, exercises, audit findings and near misses.

Chapter Summary

Cyber-risk management is an enterprise discipline that connects business objectives, threats, vulnerabilities, controls, consequences and accountability. Governance defines direction, risk appetite and oversight, while management implements and monitors the agreed approach. The NIST CSF provides flexible outcomes across Govern, Identify, Protect, Detect, Respond and Recover; ISO/IEC 27001 provides an auditable information security management system; and the CIS Controls provide prioritized practical safeguards.

Qualitative methods are useful when evidence is limited, but their categories must be defined and justified. Quantitative methods such as ALE = SLE × ARO support economic comparison, provided assumptions, uncertainty and correlation are addressed. Control selection should consider effectiveness, cost, usability, assurance, privacy and dependencies. Vendor risk, supply-chain concentration, compliance, privacy, cyber insurance and audit all form part of the strategic picture.

Boards require concise reporting about material exposure, tolerance, trends, ownership and decisions. No framework or model eliminates uncertainty. Mature organizations make assumptions visible, test resilience, stage investment, learn continuously and ensure that residual risk is consciously accepted by an authorized owner.

Key Terms

Cyber-risk: The effect of uncertainty on objectives arising from digital systems, information or technology dependencies.

Risk appetite: The broad amount and type of risk an organization is willing to pursue or retain.

Risk tolerance: Specific acceptable variation or limit for a defined risk or objective.

Inherent risk: Risk before considering the effect of controls.

Residual risk: Risk remaining after controls and treatments are applied.

Risk owner: Person accountable for managing and accepting a defined risk.

NIST CSF: A framework organizing cybersecurity outcomes into Govern, Identify, Protect, Detect, Respond and Recover.

ISO/IEC 27001: A standard specifying requirements for an information security management system.

CIS Controls: A prioritized set of practical cybersecurity safeguards.

ISMS: Information security management system.

Threat: An event, actor or condition capable of causing harm.

Vulnerability: A weakness that can be exploited or triggered.

Control: A safeguard that reduces likelihood, impact or uncertainty.

ALE: Annualized loss expectancy, calculated in the basic model as SLE × ARO.

SLE: Single-loss expectancy from one event.

ARO: Annual rate of occurrence.

Supply-chain risk: Exposure created by suppliers, software, services and dependencies.

Residual risk acceptance: Explicit authorization to retain risk after treatment.

Security economics: Application of economic reasoning to security investment and trade-offs.

Cyber insurance: Contractual financial protection against specified cyber-related losses.

Review Questions

Short Answer Questions

1. Distinguish cyber-risk governance from day-to-day security management.
2. What are the six principal functions of the NIST CSF?
3. Define inherent risk and residual risk.
4. Why is compliance not equivalent to effective cybersecurity?
5. State two limitations of quantitative cyber-risk analysis.

Long Answer Questions

1. Compare the purposes and limitations of the NIST CSF, ISO/IEC 27001 and CIS Controls.
2. Explain how a board should oversee cyber risk without attempting to manage technical operations.
3. Discuss the factors that should influence cybersecurity budget allocation.
4. Describe a complete vendor and supply-chain risk-management lifecycle.
5. Explain how privacy, ethics and security objectives can conflict during control selection.

Analytical / Application Questions

1. An organization estimates a single incident loss of $250,000 and an annual occurrence rate of 0.2. Calculate the ALE and explain why the result should not be treated as a guaranteed forecast.
2. A proposed control costs $60,000 annually and reduces estimated annual loss from $140,000 to $55,000. Calculate the net annual benefit and ROSI, then identify two non-financial factors that could change the decision.
3. Design a board dashboard for a company dependent on one cloud provider. Select five metrics and explain how each could reveal concentration, resilience or control risk.

Multiple Choice Questions with Answers

Question 1

Which NIST CSF function focuses primarily on organizational context, strategy, policy, roles and oversight?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 2

An event has an estimated single-loss expectancy of $200,000 and an annual rate of occurrence of 0.25. What is the basic annualized loss expectancy?

A. $50,000 per year

B. $200,000 per year

C. $800,000 per year

D. $50 per year

Correct Answer: A. $50,000 per year

Question 3

Which statement best describes residual risk?

A. Risk before any controls are considered

B. Risk remaining after controls and treatments are applied

C. Risk transferred entirely to an insurer

D. Risk that has already resulted in a loss

Correct Answer: B. Risk remaining after controls and treatments are applied

Question 4

What is the primary emphasis of ISO/IEC 27001?

A. A specific firewall architecture

B. An information security management system with continual improvement

C. A list of penetration-testing tools

D. A method for pricing cyber insurance

Correct Answer: B. An information security management system with continual improvement

Question 5

Which is the strongest reason to test restoration of backups?

A. To prove that storage capacity is unlimited

B. To verify that recovery works, including dependencies and procedures

C. To eliminate the need for incident response

D. To transfer recovery responsibility to the auditor

Correct Answer: B. To verify that recovery works, including dependencies and procedures

Question 6

Which person should normally own the business risk created by accepting downtime in a revenue-critical service?

A. Only the security analyst

B. The business executive accountable for the affected objective

C. The external insurance broker

D. The software vendor’s salesperson

Correct Answer: B. The business executive accountable for the affected objective

Question 7

A control costs $30,000 annually and reduces estimated annual loss by $47,000. What is the net annual benefit?

A. $17,000

B. $30,000

C. $47,000

D. $77,000

Correct Answer: A. $17,000

Question 8

Which statement about cyber insurance is most accurate?

A. It eliminates operational and reputational consequences

B. It transfers all security responsibilities to the insurer

C. It may cover specified losses but contains exclusions and control conditions

D. It makes preventive controls unnecessary

Correct Answer: C. It may cover specified losses but contains exclusions and control conditions

Question 9

Why can a clean third-party assurance report be insufficient for a customer’s risk decision?

A. Assurance reports never contain evidence

B. The report may have a limited scope, period or control set

C. Suppliers cannot be audited

D. Contracts cannot contain security requirements

Correct Answer: B. The report may have a limited scope, period or control set

Question 10

Which board metric is most directly an outcome or resilience measure?

A. Number of awareness modules assigned

B. Number of security meetings held

C. Percentage of employees receiving newsletters

D. Verified recovery time achieved during an exercise

Correct Answer: D. Verified recovery time achieved during an exercise