The Unsupported Claims Platform at Northbridge Mutual
Northbridge Mutual, a mid-size property insurer, runs its claims adjudication platform on 14 of its 210 Windows Server 2012 R2 hosts. Extended support has ended, and the application vendor will not certify the product on a current operating system until its Q3 release. The platform processes roughly 3,000 claims per day and stores policyholder bank details. A quantitative analysis put the annualized loss expectancy of a combined exploitation-and-ransomware scenario at $4.2 million. A full migration would cost $1.9 million and consume 11 months of joint effort with the vendor. A compensating control package - micro-segmentation around the 14 hosts, application allow-listing, and round-the-clock monitoring - is priced at $260,000 per year. The CIO argues the exposure should simply be accepted because no incident has occurred in nine years. The board-approved risk appetite statement says no single risk may carry an ALE above $2 million without a documented treatment plan.
1. Recommend a risk treatment and rebut the CIO's acceptance argument.
Read the worked answer
Treatment: mitigate, not accept. Accept is only available when residual exposure sits inside the stated appetite, and $4.2M does not.
Reasoning chain:
- Avoid (decommission the platform) is not viable: 3,000 claims/day with no alternate channel.
- Transfer (cyber insurance) shifts some financial loss but not regulatory exposure, reputational damage, or the board's own appetite rule.
- Mitigate in two layers: the $260k compensating controls as an interim treatment, and the migration as the permanent one with a dated milestone.
- Test the interim: if segmentation and allow-listing cut annualized frequency by half, residual ALE lands near $2.1M - still marginally outside appetite, which is why migration cannot be deferred indefinitely.
- The CIO's "nine clean years" is not evidence of low risk. This is a low-frequency, high-severity event; a nine-year sample says almost nothing about annualized probability. Absence of incidents usually reflects detection gaps, not safety.
Acceptance, if used at all, must be time-boxed, signed by the accountable executive at a level above the CIO, and re-presented to the board quarterly.
2. What would turn the compensating controls from a promise into an auditable control?
Read the worked answer
A control is auditable only when its design, operation, and failure modes are documented and testable.
- Named owner and procedure: who applies allow-listing rules, how changes are approved, what the segmentation policy actually permits.
- Design versus operating effectiveness: the design can be reviewed once; effectiveness must be sampled on a stated cadence (e.g., quarterly rule-set review, monthly alert triage audit).
- Coverage metric: "14 of 14 hosts segmented and on allow-list" - not "segmentation deployed."
- Exception handling: every temporary allow-list entry has an expiry date and an approver; exceptions are counted.
- Independent validation: internal audit or an external assessor tests the control rather than the team that built it.
- Evidence retention: monitoring logs kept long enough to reconstruct an incident, and aligned with the insurer's retention obligations.
Without coverage, testing cadence, and independent validation, the package is a project, not a control, and the residual risk estimate that depends on it is unsupported.
3. Define two key risk indicators with thresholds for board reporting.
Read the worked answer
Indicators must be leading, measurable from data the team already has, and tied to the treatment's assumptions.
KRI 1 - Unsupported-host exposure days. Cumulative days the 14 hosts remain outside vendor support. Amber at 60 days past support end, red at 120. Rationale: the ALE estimate assumes exposure is finite; this indicator measures whether the migration milestone is slipping, which directly invalidates the interim treatment.
KRI 2 - Control coverage deviation. Count of hosts that fail the daily segmentation and allow-listing check, expressed as a percentage of the 14. Amber at any single host failing for more than 24 hours, red at two or more concurrently. Rationale: the residual ALE of roughly $2.1M depends on the controls operating continuously; a gap week materially changes the number.
Optionally track mean time to detect on these hosts. Report all three with trend, not a single snapshot - the board needs direction of travel to judge whether the treatment plan is holding.