A risk assessment has rated unauthorized access to a customer database above the organization's risk appetite. Several controls are proposed, each with a different cost and effect. Which control should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
You don't buy an armored truck to carry groceries, and you don't use a paper bag for gold. You want just enough control to get the risk where the business is comfortable, at the best price. The trap is maximum security or minimum spend; both miss the target.
Full Explanation
Control selection in a risk-based program aims to bring residual risk within the organization's risk appetite in the most cost-effective way. The manager compares each option's expected risk reduction against its total cost of ownership, including implementation, operation and business impact, and recommends the one that achieves the target at the lowest cost. Choosing the control with the greatest reduction regardless of cost spends resources beyond what the business has said it needs, diverting funds from other risks that may still be above appetite. Choosing the cheapest control while residual risk remains above appetite fails the objective of the treatment; the risk owner would need to formally accept the excess, which is a separate decision rather than a control selection outcome. Adopting the control most peers use may be informative, but peer practice does not reflect this organization's specific risk, environment or appetite, and it substitutes popularity for analysis. Exam caveat: if no option reaches the appetite at a justifiable cost, the matter goes to the risk owner to decide among further treatment, transfer, avoidance or acceptance. Operational check: for the recommended control, document the expected residual risk, its comparison with the appetite, the total cost and the risk owner's approval of the treatment plan.