ACRM common mistakes
ACRM · Understand the traps and how to avoid them.
Treating all threat actors as interchangeable - answering attacker-motivation, targeting, and TTP questions with a single generic 'hacker' profile, usually financially motivated ransomware.
Headline coverage of ransomware dominates self-study, so candidates build one mental model of an attacker and reuse it for nation-state, insider, hacktivist, and third-party scenarios.
What to do instead
Before practice questions, write a five-row matrix (nation-state, organized crime, hacktivist, insider, vendor/third party) with columns for motivation, capability, typical initial access, preferred target, and the control that most reduces the risk. Recite it, then map each question's scenario to a row.
Describing ransomware only as encryption-for-payment, missing extortion models that add data theft, public leak threats, and downstream supply-chain or customer harm.
Study material memorized a year or more earlier goes stale, and candidates answer with the extortion model they first learned.
What to do instead
Maintain a one-page 'current extortion playbook' note: exfiltration before encryption, leak-site pressure, victim-customer notification exposure, negotiator/insurer involvement, and sanctions screening of payees. Refresh it before each study session and check whether a question's facts imply data theft even when encryption is the visible symptom.
Swapping qualitative heat-map ratings for quantified loss figures - answering a dollar-exposure question with 'high/medium/low' language, or treating an ordinal score as a cardinal number that can be multiplied or averaged.
Most organizational risk registers are qualitative, so candidates default to the vocabulary they use at work even when the question specifies quantification.
What to do instead
Classify the question stem first: does it ask for ranking, for a monetary estimate, or for model inputs? Only then choose technique. State aloud that ordinal scales cannot be arithmetically combined, and reserve dollar answers for frequency-times-severity reasoning.
Applying the same control benefit twice - first assuming a control reduces likelihood, then again reducing impact - or rating residual risk without documenting which controls were credited.
Inherent-versus-residual risk is a distinction candidates blur when the scenario reads as a single narrative rather than explicit stages.
What to do instead
Force a three-column layout on scratch paper: inherent exposure, named controls with the factor each affects (frequency or magnitude), residual exposure. If a control is listed twice or affects no stated factor, it earns no credit.
Computing single-loss expectancy and annualized loss expectancy without checking units - multiplying an annual rate of occurrence by a per-event loss and then reporting it as a per-incident figure, or omitting frequency entirely.
The formulas are short and feel trivial, so candidates skip writing them down under time pressure and lose track of what each number represents.
What to do instead
Write the formula and the unit for every quantity before substituting numbers ('events/year' times 'dollars/event' equals 'dollars/year'). At the end, re-read the question's ask and confirm the unit of the answer matches it.
Conflating risk-analysis factors - using vulnerability and threat-event frequency as synonyms, or treating annualized rate of occurrence and loss-event frequency as the same input.
Different frameworks use overlapping but non-identical vocabularies, and candidates memorize labels without the relationships between them.
What to do instead
Build a definition card for frequency-type factors versus susceptibility-type factors versus magnitude-type factors, noting which multiply into which. For each practice item, name each factor in the stem's own words before selecting an answer.
Assuming a loss is covered by the cyber policy when it actually belongs to technology errors-and-omissions, crime/fidelity, property, or directors-and-officers coverage - or assuming unaddressed 'silent cyber' exposure is affirmatively insured.
Cyber policies overlap in wording with other lines, and candidates reason from the nature of the incident rather than from which policy grant responds.
What to do instead
Keep a coverage-allocation table: first-party response costs, first-party business interruption, third-party liability, regulatory defense, and crime - each with the policy line that typically grants it. For every scenario, answer 'which grant, which policy, which trigger' before choosing.
Calculating recovery off the policy limit rather than the applicable sublimit, ignoring the retention or self-insured retention, or missing that the policy is claims-made with a retroactive date and a notice condition.
Candidates focus on the headline limit and the incident narrative, treating conditions and sublimits as boilerplate.
What to do instead
For each insurance question, run a fixed checklist: limit, sublimit for that cost category, retention and whether it is per-claim or aggregate, trigger (claims-made versus occurrence), retroactive date, and notice deadline. Compute only after the checklist is complete.
Answering notification questions as if one uniform breach-notification rule applies - naming a single deadline or regulator regardless of the jurisdiction, sector, or contract at issue.
Candidates recall one commonly cited deadline and generalize it, missing that obligations stack across contract, state statute, sector regulator, and non-US law.
What to do instead
Use a four-layer template - contractual notice, state or national breach law, sector regulator (health, financial services, securities), and cross-border regimes - and note that the binding deadline is usually the shortest applicable one. Identify the layers present in the fact pattern before answering.
Skipping incident-response sequencing - jumping to ransom payment or customer communication before containment and evidence preservation, or misassigning the decision authority for payment, disclosure, or privilege.
Scenarios are written to feel urgent, and candidates mirror the pressure by choosing the most visible action rather than the correct next step in the lifecycle.
What to do instead
Memorize a lifecycle skeleton (detect, triage, contain, preserve evidence, investigate, notify, remediate, learn) and, for each stage, the role that owns it. When two answers both seem reasonable, choose the earlier-stage action that keeps later options open.