Customer Analytics SaaS: Quantifying and Treating Residual Risk
Helio Devices, a 1,900-employee medical device maker with $460M revenue, is evaluating a customer analytics SaaS for its 55 hospital clients. The platform would ingest de-identified clinical data. Security estimates a data-exposure incident would cost $4.2M in forensics, notification, credit monitoring, and contract penalties. Historical near misses suggest an 18% annual likelihood without additional controls. The vendor offers customer-managed encryption keys and a private network link for $310,000 per year; the vendor's assessment says this reduces likelihood to 6% but does not change impact. Cyber insurance costs $180,000 per year with a $1M deductible and covers 60% of losses above the deductible. The board's risk appetite states annualized loss expectancy for customer data must not exceed $250,000. The CFO wants to sign the three-year contract next week; the CISO is asked whether the proposed control package is sufficient and what to recommend.
1. Calculate the baseline and post-control annualized loss expectancy (ALE). Does the proposed encryption and private-link package meet the board's risk appetite? Show your arithmetic and state any assumptions.
Read the worked answer
ALE = single loss expectancy x annualized rate of occurrence. Baseline: $4.2M x 0.18 = $756,000. Post-control: $4.2M x 0.06 = $252,000. The proposed package leaves gross ALE $2,000 above the $250,000 appetite, so it does not meet the stated threshold. This assumes the vendor's 6% estimate is credible, impact stays at $4.2M, and insurance does not reduce gross ALE.
Insurance changes retained loss, not likelihood. With a $1M deductible and 60% coverage above it, a $4.2M incident leaves $1M + 40% x $3.2M = $2.28M retained. Post-control retained ALE is 0.06 x $2.28M = $136,800, plus $180,000 premium and $310,000 control cost, for about $626,800 annual program cost. The gross test still fails narrowly, so the decision cannot be 'accept as compliant.'
2. Recommend a treatment decision. Consider mitigate, transfer, avoid, and accept, and account for the control cost, insurance, and residual risk. What would you put in writing to the CFO?
Read the worked answer
Recommend conditional mitigation, not simple acceptance. The baseline $756,000 is three times appetite; the vendor control gets within 1% of appetite but still exceeds it. Options: (1) add a low-cost control that lowers likelihood to at most 5.95% ($250,000 / $4.2M) or lowers impact - field-level tokenization, data minimization, or restricting which hospital clients can use the platform; (2) buy the insurance as a transfer layer, but document that transfer does not eliminate the gross ALE and costs $180,000; (3) avoid or delay signing until contract terms allocate breach costs and permit audit.
I would not sign a three-year deal on a 6% estimate alone. Put in writing: baseline and residual ALE, the $2,000 gap, the sensitivity range, the insurance retained-loss math, and a condition that the vendor accept a security addendum, provide evidence of key management, and allow annual review. If the board accepts the residual gap, record it as a formal risk exception with owner and expiry.
3. What sensitivity analysis or evidence would you require before signing, and how would a three-year term change the decision?
Read the worked answer
Require evidence: the internal incident data behind the 18% estimate, a vendor penetration-test summary and SOC 2 report, the architecture for key custody and private link, and contractual breach-notification and liability terms. Test sensitivity: if likelihood is 8% rather than 6%, ALE is $336,000; if impact is $5M, even 5% gives $250,000. A three-year term matters because control efficacy decays, insurance premiums reset, and hospital contracts may change.
Negotiate annual termination for security failure, audit rights, data-return and deletion terms, and a liability cap at least equal to the $4.2M impact. Revisit at 12 months with measured control performance. Do not let the CFO treat the vendor's likelihood estimate as a guarantee; require a range and a review trigger if key-management or access-control evidence is missing.