Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You…

Question

Options

• AGet approval from the board of directors
• BScreen potential vendor solutions
• CVerify that the cost of mitigation is less than the risk
• DCreate a risk metrics for all unmitigated risks

• A
  11% (2)
• C
  74% (14)
• D
  16% (3)

Explanation

Option C is correct because cost-benefit analysis must be performed before committing to any control implementation - if the cost of mitigating a risk exceeds the potential loss from the risk itself, it may not be economically rational to implement that control. This is a foundational principle: identified solutions are candidates, not commitments, until validated against the value of the risk they address.

Why the distractors are wrong:

• A (Board approval) comes after you've already done the cost-benefit analysis and selected your controls - you present a justified recommendation, not a list of unvalidated options.
• B (Screen vendors) is a step that happens during or after control selection, once you know what kind of solution you actually need and have confirmed it's worth pursuing.
• D (Risk metrics) is a reporting/monitoring activity; unmitigated risks should already be documented from the risk assessment itself, and creating metrics doesn't advance the control implementation process.

Memory tip: Think of it as the "Is it worth it?" checkpoint - you always ask before you buy. The sequence is: Identify risk → Find potential solution → Check if cost < risk → Then proceed (screen vendors, select, get approval). C is the gate you pass through before any further action.

No community discussion yet for this question.