Sara, the Chief Security Officer (CSO), has had four security breaches during the past two years. Each breach has cost the company $3,000. A third party vendor has offered to repair the security…

The correct answer is D. Transfer the risk saving $5,000. The math: 4 breaches over 2 years = 2 breaches/year. With 5 years remaining, expected future loss = 10 breaches × $3,000 = $30,000. The vendor repair costs $25,000. Paying the vendor to address the risk (transferring or offloading the remediation to a third party) results in a…

Security program management and oversight

Question

Sara, the Chief Security Officer (CSO), has had four security breaches during the past two years. Each breach has cost the company $3,000. A third party vendor has offered to repair the security hole in the system for $25,000. The breached system is scheduled to be replaced in five years. Which of the following should Sara do to address the risk?

Options

AAccept the risk saving $10,000.
BIgnore the risk saving $5,000.
CMitigate the risk saving $10,000.
DTransfer the risk saving $5,000.

How the community answered

(45 responses)

A
4% (2)
B
20% (9)
C
11% (5)
D
64% (29)

Explanation

The math: 4 breaches over 2 years = 2 breaches/year. With 5 years remaining, expected future loss = 10 breaches × $3,000 = $30,000. The vendor repair costs $25,000. Paying the vendor to address the risk (transferring or offloading the remediation to a third party) results in a net savings of $5,000 ($30,000 – $25,000). This matches option D. Accepting the risk (A) means paying $30,000 in breach costs - no real savings vs. the vendor option. Options A and C cite $10,000 savings, which does not match the calculations. Ignoring risk (B) is ethically and professionally inappropriate and carries the same financial burden as accepting it.

Topics

#risk management#risk transfer#ALE#cost-benefit analysis

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice