Script Integrity Monitoring or Re-platforming: A Quantitative Risk Call
Cedar & Fold is a 320-store apparel retailer with EUR 1.1bn revenue. Its risk team has quantified the dominant scenario for the web checkout: a client-side script compromise of the payment page. Single loss expectancy is EUR 2.4M, covering forensics, card reissuance, regulatory exposure and measured churn. The estimated annualised rate of occurrence is 0.30. PCI DSS v4.0 now requires inventory and tamper monitoring of payment-page scripts (requirements 6.4.3 and 11.6.1), and the acquirer has asked for evidence. Two treatments are on the table. Option A: script integrity monitoring, content security policy in report-then-enforce mode, and a third-party script register at EUR 180k per year, reducing ARO to 0.05. Option B: re-platform checkout to a hosted payment page, EUR 1.6M over 24 months, reducing ARO to 0.01 after cut-over. The board's stated risk appetite is EUR 500k annualised per risk, and the CFO prefers cyber insurance at EUR 310k premium for a EUR 1M limit with a EUR 250k retention.
1. Calculate the annualised loss expectancy and evaluate both options. What do you recommend, and what would change your recommendation?
Read the worked answer
ALE before treatment is 0.30 x 2.4M = EUR 720k, which already breaches the EUR 500k appetite, so something must be done now.
Option A: residual ALE is 0.05 x 2.4M = EUR 120k, plus EUR 180k of control cost, giving EUR 300k total - below appetite and roughly EUR 420k cheaper than the untreated ALE.
Option B: residual after cut-over is 0.01 x 2.4M = EUR 24k, which looks better, but the benefit arrives in year three. During the 24-month build the ARO stays at 0.30, so expected loss across the build is about 0.6 events, or EUR 1.44M, on top of EUR 1.6M of spend. That exposure is what the comparison must include. Amortised over a three-year life, B costs roughly EUR 533k per year plus EUR 24k residual, still above A.
Recommend A now, with B re-scoped so the hosted payment page can be delivered by iframe in months rather than years. Change my mind if the ARO estimate is unreliable: at an ARO of 0.10 the ALE is only EUR 240k and A costs more than the loss it prevents, so I would buy a cheaper subset and spend the difference on the re-platform.
2. The CFO argues insurance is cheaper than Option A. Evaluate that argument.
Read the worked answer
Insurance transfers some financial consequence; it does not reduce the probability of the event or discharge the obligation to protect cardholder data. Three problems with treating it as a substitute:
First, arithmetic. The EUR 1M limit sits against a EUR 2.4M single loss expectancy, with a EUR 250k retention, so a single event still leaves roughly EUR 1.65M on the company's books. The premium is EUR 310k against an ALE of EUR 720k - about 43 percent of the expected loss - and it buys coverage for one bad year, not control.
Second, coverage gaps. Fines and penalties, card scheme assessments and reissuance costs are commonly excluded or sub-limited, and reputational and churn losses are rarely recoverable. Insurers also impose control warranties; failing to meet them can void the claim, which means the monitoring controls may be a condition of cover anyway.
Third, regulatory. The acquirer is asking for evidence against PCI DSS 6.4.3 and 11.6.1, and a policy certificate is not evidence of script tamper monitoring.
The defensible combination is Option A plus insurance sized to the residual tail, not insurance instead of controls.
3. How should the residual risk be recorded, monitored and escalated over the next year?
Read the worked answer
The register entry should carry the scenario as written, the SLE and ARO with their confidence intervals and the assumptions behind them (record volume, reissuance cost, churn estimate), the named risk owner (typically the Head of Digital Commerce, not the CISO, who does not own the checkout), the treatment decision, the residual ALE, the acceptance date and expiry, and the review cadence. Recording assumptions matters because these estimates will be challenged and re-estimated.
Monitoring should include both control effectiveness and risk drivers. Test the monitoring control quarterly by injecting a benign unauthorised script and confirming detection and alerting, because an untested detector is an assumption. Track the number of third-party scripts on the payment page, unauthorised change attempts, CSP violation volume, and any change of checkout vendor or CDN.
Escalation triggers: residual exceeding the appetite threshold, detection failures in testing, a new script vendor, an architecture change, a peer breach with a similar mechanism, or an acquirer or audit finding. Each trigger forces a re-estimation rather than waiting for the quarterly cycle. Report to the risk committee monthly, to the board quarterly.