Cyber Risk at a Payments Processor
Halverston Payments processes card transactions for 4,000 small merchants. It holds cardholder data for 2.3 million customers. Last year a phishing incident compromised a mid-level administrator account; the intruder was detected after nine days and no data left the network, but forensic costs reached £600,000. The board's risk register lists cyber risk as 'high likelihood, medium impact' with no quantified exposure. The CISO has proposed a £4m three-year programme covering multi-factor authentication, network segmentation, and a 24/7 security operations centre. The CEO argues the firm is 'too small to be a target'. The largest merchant client has begun asking for evidence of security controls in contract renewals. The firm's cyber insurance covers £5m with a £250,000 excess and excludes regulatory fines.
1. Critique the board's risk register entry and recommend how cyber risk should be assessed and expressed.
Read the worked answer
The register entry is unusable for decision-making. 'High likelihood, medium impact' is a label, not an assessment, and it is internally inconsistent: an incident that cost £600,000 in forensics alone, in a firm holding 2.3 million cardholder records, has potentially severe impact, not medium. The nine-day detection window shows the control environment failed to detect promptly, which raises both likelihood and impact. With no quantified exposure, the board cannot compare the £4m programme against the risk it mitigates, so the CISO's proposal is being judged on cost alone.
A better approach quantifies in ranges. Likelihood should be expressed as an annual frequency estimate informed by the phishing incident and sector breach data. Impact should model scenarios: forensic and remediation costs, business interruption, merchant attrition if a breach becomes public, regulatory penalties, and contractual liability. These should be aggregated into an expected annual loss and a severe-but-plausible tail scenario, both stated with ranges and assumptions. The register should record the risk owner, the specific controls in place, the residual exposure after controls, and the board's tolerance. Expressed this way, the £4m programme can be tested against the reduction in expected and tail loss, and the CEO's 'too small to be a target' claim can be rebutted: attackers target data, not size, and 2.3 million records is a substantial prize.
2. Advise the board on how to decide whether to fund the £4m programme.
Read the worked answer
The decision should be framed as risk reduction per pound, not as a binary spend. First, decompose the programme: multi-factor authentication and network segmentation are foundational controls that directly address the observed failure, the compromised administrator account and the nine-day detection gap. The 24/7 security operations centre is the most expensive element and may be partially outsourced or shared, so it should be appraised separately rather than bundled.
Second, estimate the reduction in expected annual loss and tail exposure each element delivers, and compare with its cost. Foundational controls typically deliver high reduction at modest cost; the SOC delivers detection-speed improvement whose value depends on how much loss faster detection avoids. Third, account for the insurance: with £5m cover and a £250,000 excess, the firm retains the excess and any uninsured items such as regulatory fines, so insurance complements but does not substitute for controls, and insurers increasingly require the very controls proposed. Fourth, weigh commercial necessity: the largest merchant's contract renewals now depend on demonstrated controls, so some spend is revenue-protecting, not merely loss-avoiding. A staged approval, funding MFA and segmentation immediately and piloting the SOC, balances urgency against the CEO's cost concern and gives the board evidence for the remainder.