712-50 Question 189
Single answerQuantitative Rational Decision MakingA CISO is deciding whether to fund a data loss prevention (DLP) program for a business unit that handles customer financial records. Historical analysis shows that the annualized rate of occurrence (ARO) for a material data exfiltration incident is 0.2, and the single loss expectancy (SLE) is estimated at $2,000,000. The proposed DLP program will cost $180,000 per year to operate and is expected to reduce the ARO to 0.05, with no change to the SLE if an incident occurs. Based on quantitative rational decision making, what is the MOST financially justified recommendation?
- A
Approve the DLP program because the annualized loss expectancy (ALE) is reduced from $400,000 to $100,000, producing a net expected annual benefit of $120,000
- B
Reject the DLP program because the SLE remains unchanged, so the control does not reduce risk in financial terms
- C
Approve the DLP program because any control that lowers the ARO below 0.1 is automatically cost-effective
- D
Reject the DLP program because the control cost of $180,000 exceeds the reduced ALE of $100,000
Show answer and explanation
Correct answer: A
Explanation
Quantitative rational decision making in security investment typically uses metrics such as SLE, ARO, and ALE to estimate expected loss exposure and compare it to the cost of controls. The standard formula is ALE = SLE x ARO. In this scenario, the baseline ALE is $400,000 and the residual ALE after DLP is $100,000, so the annual risk reduction is $300,000. Since the control costs $180,000 annually, the organization gains a positive expected value of $120,000 per year. This is consistent with established information risk management practice, including classic quantitative methods described in common security management references such as NIST risk management guidance and industry-standard risk analysis approaches. While executive decisions may also consider legal, regulatory, customer trust, and strategic factors, the quantitatively rational answer based strictly on expected financial impact is to approve the DLP program.
- A. Correct.
Correct. Before the control, ALE = SLE x ARO = $2,000,000 x 0.2 = $400,000. After the control, ALE = $2,000,000 x 0.05 = $100,000. The reduction in expected annual loss is $300,000. After subtracting the annual operating cost of $180,000, the net expected annual benefit is $120,000. Under quantitative decision making, this supports approving the DLP investment because the expected risk reduction exceeds the control cost.
- B. Incorrect.
Incorrect. A control can still be financially justified even if it does not change SLE, as long as it reduces either the probability of occurrence or the expected frequency enough to lower ALE. In this case, reducing ARO from 0.2 to 0.05 materially lowers expected annual loss. This option reflects the misconception that only impact reduction matters in quantitative analysis.
- C. Incorrect.
Incorrect. There is no general quantitative rule that an ARO below 0.1 automatically makes a control cost-effective. Cost-effectiveness depends on the relationship among baseline ALE, residual ALE, and the total cost of the control. A lower ARO may still not justify a control if the implementation and operating costs exceed the expected risk reduction.
- D. Incorrect.
Incorrect. This compares the control cost to the residual ALE alone, which is not the correct decision basis. The right comparison is between the amount of risk reduction achieved and the cost of the control. Here, the control reduces ALE by $300,000 annually, which is greater than the $180,000 annual cost, so the investment is financially justified.