Allocating a Fixed Security Budget Under a Regulatory Deadline
Merganser Insurance Group, a regional P&C carrier with 1,400 employees, has $1.2M of discretionary security funding for the coming fiscal year. An external assessment found: MFA on 62% of accounts with administrative accounts excluded; EDR on 71% of endpoints with servers excluded; immutable backups restored in only 2 of the last 8 quarterly tests; no incident response plan exercise since 2022; an 11% phishing simulation click rate; no segmentation between the claims platform and corporate IT. The current tested restore time for tier-1 systems is six days. The regulator's new guidance demands demonstrable recovery of critical operations within 48 hours, and an examination begins in ten months. The CISO proposes $400k for EDR expansion, $350k for MFA, $250k for tabletops and an IR retainer, and $200k for a segmentation pilot.
1. Allocate the $1.2M and defend it, accounting for the ten-month examination window.
Read the worked answer
Sequence by what can be completed, evidenced and defended inside ten months, then by risk reduction per dollar.
Suggested allocation: $350k MFA, completing privileged-account coverage - fast, closes the most-cited finding, and is the highest-leverage control against credential-based intrusion; exclude nothing this time. $250k backup and restore re-architecture plus testing - the 48-hour requirement is an architecture and testing problem, and no amount of detection spending moves a six-day restore time. $400k EDR expansion to servers closes a documented blind spot and produces the detection metrics the examiner will ask for. $100k tabletop and IR retainer, reduced from $250k - tabletops are cheap, repeatable, and two can run before the exam. $100k segmentation pilot scoped to the claims platform only, framed as funded phase one with a milestone date.
What this trades away is full segmentation inside the window. Promising a multi-year architectural change in ten months is undeliverable and produces a worse regulatory outcome than an honest phased plan with stated milestones and evidence.
2. Name three metrics that would demonstrate resilience to the regulator, with baselines and targets, and explain why you chose them.
Read the worked answer
Metrics should be few, trended, and tied to a claim the regulator can independently test.
- Privileged accounts protected by phishing-resistant MFA: baseline 0% (admin accounts excluded), target 100% by month six, reported monthly. Chosen because it maps to the assessment finding and is binary and auditable.
- Tested restore time for tier-1 systems: baseline six days, target 48 hours or less, demonstrated through documented quarterly tests with four consecutive successes. Chosen because it maps directly onto the 48-hour guidance and because a single successful test proves almost nothing.
- Mean time to detect and contain in an exercise: baseline untested since 2022, target detection within 24 hours and containment within 72 in a tabletop or red-team scenario, with findings tracked to closure.
Optional supporting indicators: percentage of servers with EDR reporting to the SOC (baseline 0%), and click rate (11%) as a leading indicator rather than a compliance artifact. Presentation matters as much as selection: each metric needs an owner, a measurement method, the underlying evidence, and a trend line. A single improved number with no baseline reads as a slide, not a control.
3. The CFO proposes buying $5M of additional cyber limit instead of funding the segmentation pilot. Evaluate.
Read the worked answer
They answer different questions and should not be presented as substitutes. Insurance transfers financial consequence; it does not restore operations, satisfy the 48-hour guidance, or clear the regulatory finding. The examiner's question is whether critical operations recover - a limit cannot answer it.
Segmentation also reduces the severity of the scenarios the insurance is priced against, so the two interact. Buying limit while leaving the claims platform flat against corporate IT may raise premium at renewal and invite control-related conditions or exclusions.
Where the CFO is right: if the residual tail after existing controls exceeds the current tower, additional limit is a legitimate, fast purchase, and the single-year cash profile of premium versus a $3M capital project may genuinely favor insurance. The defensible answer funds a reduced segmentation pilot plus a modest limit increase. Buying the limit with no resilience spend leaves the firm holding a covered loss alongside an unaddressed finding - the worst of both positions.