Study. uk . com
  1. Home
  2. All questions
  3. Question 323

CISM study material · question 323 of 1000

A potential breach of design plans is estimated to cost 750,000 while full disk encryption and remote tracking would cost 275,000. Which conclusion follows from the cost-benefit reasoning IR 8286 describes?

  1. The decision cannot be made without knowing the likelihood of detection
  2. The organisation should transfer the risk instead
  3. The countermeasure is unjustified, because it does not eliminate the risk
  4. The countermeasure is justified, because its cost is less than the exposure it prevents
Show the answer

Answer: D. The countermeasure is justified, because its cost is less than the exposure it prevents

IR 8286 uses this worked example: a cost-benefit analysis weighs the expected cost of the exposure against the potential cost of the response, and where the response costs less than the loss it prevents, the benefit is worth the cost.

Source: NIST IR 8286 (NIST) — Sec. 3.5.2 Responding to Residual Risk

Challenge yourself on this topic → Study as cards