Risk Appetite and Control Mapping at PayLoom
PayLoom processes 2.5 million card transactions per day and is subject to PCI DSS v4.0, GDPR, and SOC 2 Type II. It runs 140 microservices, 60 in PCI scope. The CTO wants to buy a continuous-compliance platform, but the security team has only 12 people. A recent penetration test found 12 high-risk findings; 5 sit on legacy services that cannot be patched because of a three-year vendor lock. The risk register has 300 entries, 45 critical, but no board-approved risk appetite statement. A GDPR data subject access request backlog stands at 1,200 requests and regulators have asked for evidence of timely response. The board wants a risk report in two weeks that explains why the critical findings remain open and what management recommends. The CTO is pushing to accept the 5 legacy risks so the product roadmap can proceed.
1. Define risk appetite and tolerance for PayLoom and apply them to the 5 unpatched legacy findings. What should management recommend to the board?
Read the worked answer
Define risk appetite as board-approved statements with measurable thresholds, then apply them to the legacy findings.
- Appetite statements: e.g., 'Zero tolerance for unauthorized access to cardholder data'; 'Accept up to 5 high-risk findings on non-customer-facing systems with compensating controls for no more than 90 days'; 'No critical finding may remain open beyond 30 days without board notification.'
- Apply to the 5 vendor-locked findings: If they are in PCI scope and exploitable, they exceed appetite. The treatment is not 'accept' - it is 'mitigate with compensating controls plus transfer/avoid' (e.g., isolate the legacy service behind a segmentation gateway, add virtual patching, negotiate vendor escrow). If the vendor cannot provide a patch within 90 days, escalate to the board with documented residual risk and a plan to replace the service.
- Use a risk matrix with likelihood (exploitability) and impact (data sensitivity, regulatory fine). The 5 findings likely score high because vendor lock increases exposure duration.
- Report the appetite breach explicitly; the board can accept residual risk, but only with eyes open.
Reasoning: Without an appetite statement, every exception becomes a negotiation. Thresholds force consistent decisions and make board acceptance explicit.
2. How should PayLoom map controls across PCI DSS v4.0, GDPR, and SOC 2 to reduce duplicate work for a 12-person security team?
Read the worked answer
Build a unified control framework with PCI DSS, GDPR, and SOC 2 as 'views' rather than separate programs.
- Map once, comply many: Create a control catalog (e.g., NIST CSF or ISO 27001 as the spine). Map each control to PCI DSS v4.0 requirements, GDPR articles (Art. 32 security, Art. 30 records, Art. 33 breach notification), and SOC 2 TSC (Security, Availability, Confidentiality). For example, encryption at rest maps to PCI 3.5, GDPR Art. 32(1)(a), and SOC 2 CC6.1.
- Prioritize continuous compliance for the 60 PCI-scoped microservices: Automate evidence collection for access reviews, encryption, logging, and vulnerability scans. Do not try to automate all 140 at once.
- Use the 12 pen-test findings to drive remediation: They likely satisfy multiple frameworks; fix once and attach evidence to all three.
- Deduplicate evidence requests: A single evidence repository with control IDs cuts audit effort.
Reasoning: Separate compliance silos cause duplicate work for a small team. A mapped control set lets the team evidence once and satisfy PCI, GDPR, and SOC 2.
3. Recommend a treatment plan for a vendor-locked legacy service with 5 high-risk findings. What compensating controls and board communication are needed?
Read the worked answer
Use a compensating-control package and a time-bound risk acceptance, with a replacement business case.
- Compensating controls: Network segmentation to isolate the legacy service; WAF/IPS virtual patching; strict allow-list egress; enhanced logging and anomaly detection; frequent credential rotation; application-layer authentication.
- Vendor negotiation: Require a security addendum, patch SLA, and right to audit. If the vendor refuses, document it as third-party risk and start a replacement roadmap.
- Risk treatment: Accept residual risk only for a defined period (e.g., 180 days) with business owner sign-off and board notification because the findings are high-risk. Set a trigger: if a public exploit appears, emergency isolate.
- Board communication: State the exposure in business terms - potential card data breach, regulatory fine, contract loss - and the cost/timeline to replace.
Reasoning: 'Cannot patch' is not 'cannot mitigate.' Compensating controls reduce likelihood and impact while the organization plans replacement. Acceptance without a plan is negligence.