Risk Treatment Under Budget and Outsourcing Constraints
A regional bank with 1.2 million customers has completed an EBIOS RM study. Eight strategic scenarios were retained; the executive committee will fund only three. The top scenarios are ransomware on the outsourced core banking platform, credential stuffing on the mobile app, and insider fraud in payment operations. The bank has €4 million over three years, a 14-person security team, and a core-banking contract that puts infrastructure controls with the provider. Proposed measures include MFA for all staff, network segmentation of the payment operations VLAN, a SOAR platform, DLP for payment files, and quarterly tabletop exercises. The mobile app already has device binding but no rate limiting; payment operations has 60 staff with shared admin accounts. The provider's SLA mentions 'industry-standard security' but gives no audit rights. The CRO wants a risk-acceptance decision for anything not funded, while the CIO wants quick wins before the next board meeting.
1. How should the bank prioritise the proposed measures across the three funded scenarios? Consider effectiveness, cost, dependencies and residual risk.
Read the worked answer
Prioritise measures that reduce more than one scenario and do not depend on the provider. MFA for all staff, especially payment operations, plus removal of shared admin accounts and rate limiting on the mobile app are quick, low-dependency wins: they cut credential stuffing and insider fraud and reduce lateral movement in a ransomware event. Segmentation of the payment VLAN is a stronger control but needs design and change control; fund it next because it limits blast radius. DLP for payment files supports the insider scenario and creates evidence, but it is slower and needs tuning. SOAR is costly and depends on log quality; defer it unless the bank can feed it reliable telemetry. Tabletop exercises are cheap and test ransomware readiness, so fund them alongside the technical quick wins. The core-banking ransomware scenario will retain significant residual risk because infrastructure control sits with the provider; measures there should include joint exercises, recovery testing and contractual audit rights, not just internal tooling.
2. What should be done about the outsourced core-banking risk, given the contract lacks audit rights? Distinguish measures the bank can take from those it must negotiate.
Read the worked answer
The bank can act on its side of the boundary: restrict and monitor its own interfaces to the provider, enforce least privilege for bank staff, test its own recovery procedures, retain independent backups where contractually possible, and run joint incident-response exercises. It can also require internal sign-off before changes that increase dependency. It must negotiate provider-side controls: audit or assessment rights, security incident notification timelines, evidence of patching and admin MFA, log access, and penetration-test summaries. Without those rights, the bank cannot verify 'industry-standard security' and should record a high residual risk with a named owner. The wrong response is to treat the SLA wording as assurance or to fund only internal tools while ignoring the contractual gap. The right response combines what the bank controls with a clear escalation of what it must renegotiate.
3. How should residual risk acceptance be documented and decided for the unfunded scenarios? Who should own it?
Read the worked answer
Document each unfunded scenario with its inherent risk, the measures actually funded, the resulting residual risk rating, the rationale, the assumptions, and the conditions under which the decision must be revisited. The acceptance should be explicit and time-bound, with monitoring indicators such as incident trends, audit findings or provider evidence. Ownership belongs to the business or risk owner who can bear the consequence, normally the CRO or the relevant executive, with the CISO providing advice and evidence; the CISO should not accept business risk alone. The executive committee should see the trade-off between the three funded scenarios and the accepted residual risk, including the provider-dependent risk that the bank cannot verify. 'Not funded' must mean 'accepted with eyes open', not 'ignored'.