CAS-002 · Question #844
A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number…
The correct answer is A. -$30,000. The 3-year ROI is -$30,000 because the $150,000 in incident savings is outweighed by the $180,000 total SIEM subscription cost.
Question
A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the amount spent investigating incidents. Proposal:
External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%. The company currently has ten security incidents per annum at an average cost of $10,000 per incident. Which of the following is the ROI for this proposal after three years?
Options
- A-$30,000
- B$120,000
- C$150,000
- D$180,000
How the community answered
(45 responses)- A49% (22)
- B33% (15)
- C11% (5)
- D7% (3)
Why each option
The 3-year ROI is -$30,000 because the $150,000 in incident savings is outweighed by the $180,000 total SIEM subscription cost.
The SIEM costs $5,000/month x 36 months = $180,000 total over three years. The 50% reduction in incidents saves 5 incidents/year x $10,000/incident x 3 years = $150,000 in avoided costs. ROI = $150,000 - $180,000 = -$30,000, meaning the proposal does not break even within the three-year window.
$120,000 does not correspond to any valid combination of the given cost and savings figures.
$150,000 represents only the gross savings from incident reduction over three years without subtracting the total cost of the SIEM subscription.
$180,000 is the total 3-year subscription cost of the SIEM solution, not the net ROI.
Concept tested: Security investment ROI and cost-benefit calculation
Source: https://csrc.nist.gov/publications/detail/sp/800-55/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.