Funding the Right Controls Under a Fixed Security Budget
Northgate Community Health is a 14-site outpatient group with 900 staff and a $120,000 cybersecurity budget for the coming year. The electronic health record is vendor-hosted, but each site keeps a local file share holding scanned intake forms, referral letters and insurance cards. A risk assessment produced one quantified scenario: a ransomware event reaching those shares has a single loss expectancy of $1.8 million and an annualized rate of occurrence estimated at 0.15, giving an ALE of $270,000. Supporting data is thin - the ARO came from two industry reports and one near-miss, and the SLE excludes regulatory penalties and reputational harm.
Four candidate investments are on the table: MFA for remote access and email ($45,000); endpoint detection and response across 950 endpoints ($70,000); a phishing simulation and awareness programme ($25,000); and network segmentation separating clinical sites from the data centre ($90,000). Last year's phishing simulation click rate was 31%, and three of the four incidents in the past two years began with stolen or guessed credentials. The CISO must recommend an allocation to the board in three weeks.
1. Allocate the $120,000 and justify the decision using the risk data provided. State explicitly what you are not funding and why.
Read the worked answer
Recommendation: MFA ($45,000) plus EDR ($70,000) = $115,000, with the remaining $5,000 ring-fenced for backup restore testing. Defer segmentation; run awareness through the existing LMS at marginal cost.
Reasoning, in order of the loss scenario:
- The scenario only becomes a $1.8 million event if an attacker gets initial access and moves laterally to the file shares. Three of four historical incidents began with credentials, so MFA attacks the dominant initial-access path, is quick to deploy, and is cheap per unit of risk reduced.
- EDR addresses the second stage: detecting and containing spread to the shares that carry the loss estimate. Neither control alone covers the modelled event.
- Awareness training is not worthless, but click-rate improvement is a proxy metric with a weak, slow relationship to incident frequency - it is the lowest value per dollar at this maturity.
- Segmentation is the strongest long-term control for this exact scenario, but at $90,000 it consumes 75% of the budget and usually overruns. Funding it alone would leave credential exposure unaddressed, so it becomes next year's business case with a phased design.
Assumptions to state: MFA covers VPN, email and admin consoles; EDR includes monitoring capacity, not just agents - detection without response staffing is weaker than the price implies. Do not claim these controls eliminate the risk.
2. The CFO asks how much the ALE will drop once your chosen controls are in place. What do you answer, and what would you need to produce a defensible number?
Read the worked answer
Do not give a single dollar figure. The $270,000 is already a point estimate - an SLE from one scenario multiplied by an ARO drawn from two industry reports and a near-miss. Multiplying it by a vendor-supplied 'effectiveness percentage' produces false precision and will be quoted back at you later.
What you can say honestly: the selected controls reduce the likelihood of the modelled event (MFA blocks credential-only access) and reduce the severity and duration if it occurs (EDR containment shortens dwell time and limits encrypted shares). Residual ALE is therefore lower, but not quantifiable to a dollar without local data.
To produce a defensible number you would need:
- Your own incident frequency over several years, not industry averages.
- Control efficacy measured in your environment: MFA-blocked login volumes, EDR mean time to detect and contain from purple-team or tabletop exercises.
- Sensitivity analysis across a plausible ARO range (e.g. 0.05-0.30) and SLE range, presented as a distribution rather than a point.
Frame the answer as 'we expect a material reduction in likelihood and a bounded reduction in severity; here is the range and the assumptions.' Note separately that regulatory penalties, notification costs and reputational harm are outside the model entirely, so no ALE figure - before or after - captures the full exposure.
3. What residual risk must be documented and accepted after your allocation, and by whom?
Read the worked answer
Residual risks to record:
- Credential compromise survives MFA partially - MFA fatigue, help-desk reset social engineering and session-token theft remain viable.
- Flat internal network - a single compromised workstation can still reach clinical file shares; segmentation is deferred, so blast radius is unchanged.
- Recovery capability unproven - the dominant driver of ransomware loss is recovery time, and the $5,000 test may reveal that backups do not restore.
- Untested EDR efficacy - agents deployed is not the same as detections tuned and staffed.
- Data sprawl - scanned PHI on 14 local shares is itself a finding; centralising or minimising that data would reduce the SLE more than any tool.
- Out of scope entirely - third-party/vendor access, cloud configuration, and physical security at sites.
Who accepts: the CISO is accountable for documenting and monitoring, but a risk of this size must be accepted at a level with authority to carry it - the board or audit committee, not the IT manager. Record owner, acceptance date, review date (12 months or next budget cycle) and explicit trigger conditions that force re-review: any ransomware incident, an audit finding, or a material change in the ARO evidence. Acceptance without a named acceptor and an expiry is not risk management, it is an undocumented gap.