CAS-002 · Question #786
A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,000 for the next…
The correct answer is B. Second quote. Calculating the 3-year total cost of ownership for each quote shows the second quote is cheapest at $48,600, providing greater savings than the $50,000 baseline and the other two options.
Question
A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,000 for the next three years responding to and eradicating workstation malware. The Information Security Officer (ISO) has received three quotes from different companies that provide HIPS.
- The first quote requires a $10,000 one-time fee, annual cost of $6
per workstation, and a 10% annual support fee based on the number of workstations.
- The second quote requires a $15,000 one-time fee, an annual cost of
$5 per workstation, and a 12% annual fee based on the number of workstations.
- The third quote has no one-time fee, an annual cost of $8 per
workstation, and a 15% annual fee based on the number of workstations. Which solution should the company select if the contract is only valid for three years?
Options
- AFirst quote
- BSecond quote
- CThird quote
- DAccept the risk
How the community answered
(65 responses)- A6% (4)
- B74% (48)
- C5% (3)
- D15% (10)
Why each option
Calculating the 3-year total cost of ownership for each quote shows the second quote is cheapest at $48,600, providing greater savings than the $50,000 baseline and the other two options.
The first quote totals $49,600 over three years ($10,000 + $13,200 x 3), which is $1,000 more than the second quote, making it a less cost-effective choice.
The second quote 3-year total is: $15,000 one-time fee + [($5 x 2000) + 12% of ($5 x 2000)] x 3 = $15,000 + ($10,000 + $1,200) x 3 = $15,000 + $33,600 = $48,600. Quote 1 totals $49,600, Quote 3 totals $55,200, and the status quo costs $50,000, making Quote 2 the lowest total expenditure over the three-year window.
The third quote totals $55,200 over three years ($18,400 x 3 with no one-time fee), exceeding both the current $50,000 remediation spend and the other two vendor quotes.
Accepting the risk means continuing to spend the projected $50,000 over three years on malware remediation, which is $1,400 more expensive than purchasing the second quote's HIPS solution.
Concept tested: Security investment TCO and cost-benefit analysis
Source: https://csrc.nist.gov/publications/detail/sp/800-55/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.