Five risk treatment plans compete for a limited security budget that cannot fund all of them this year. How should the information security manager recommend which plans to fund?
Select an answer to reveal the explanation.
Short Explanation
With limited cash, you fix the leaks that would flood the house first, and you pick the repair that gives you the most dry floor per dollar. That's risk level plus cost-effectiveness. The trap is fairness or novelty, which feel good but don't reduce the most risk.
Full Explanation
Security spending is justified by the risk it reduces in relation to its cost, so competing treatment plans should be prioritized by the significance of the risks they address, particularly risks that exceed appetite or affect critical business processes, and by the amount of risk reduction each delivers per unit of cost. Presenting that analysis to the steering committee lets management make an informed, business-aligned funding decision. Funding by submission order rewards speed of paperwork rather than risk significance and could leave the most serious exposures untreated. Choosing plans for their use of new technology confuses innovation with value; an advanced tool that addresses a minor risk is a poor investment compared with a modest control on a critical one. Splitting the budget equally across all five plans may leave each underfunded and ineffective, so none achieves its risk reduction this year. Exam caveat: dependencies, regulatory obligations and quick wins can legitimately influence sequencing, but they should be weighed within a risk-based framework rather than replacing it. Operational check: confirm each plan's business case states the risk it addresses, its current and target residual ratings and its cost, and that the funding decision is recorded with management's rationale.