CCISO Financial Management 4

Question 1

A CISO discovers that shadow IT spending on unsanctioned SaaS tools totals $1.2M annually. What is the primary financial governance risk this presents?

Accepted Answer

Unmanaged vendor risk, data exposure, and lack of budgetary control outside procurement oversight

Answer

Shadow IT creates financial governance failures including uncontrolled vendor risk, data security exposure, and spending that bypasses procurement controls and budget accountability.

Question 2

When calculating the cost of a data breach for financial planning purposes, which category of cost is most frequently omitted in initial estimates?

Accepted Answer

Reputational damage and customer churn

Answer

Long-term reputational damage leading to customer attrition is the most frequently underestimated breach cost category because it manifests over months to years after the incident.

Question 3

A CISO is asked to develop a security metrics dashboard for the CFO. Which metric most directly links security investment to financial performance?

Accepted Answer

Cost per security incident and reduction in ALE over time

Answer

Cost per incident and ALE reduction directly connect security program performance to financial outcomes, making them most relevant to CFO-level reporting.

Question 4

A CISO must defend the security budget against cuts by showing how the program reduces financial risk. Which approach is most persuasive to a risk-aware board?

Accepted Answer

Present quantified risk reduction using threat modeling and expected loss calculations

Answer

Quantified risk reduction using financial modeling (ALE, ROSI) directly addresses board-level concern about financial exposure and is more persuasive than benchmarks or activity metrics.

Question 5

An organization is considering self-insuring against cyber risk instead of purchasing cyber insurance. What is the key financial requirement for self-insurance to be viable?

Accepted Answer

The organization must maintain sufficient financial reserves to absorb maximum probable loss

Answer

Self-insurance requires adequate financial reserves to cover potential losses; without sufficient capital reserves, a major incident could be catastrophic to the organization's financial health.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Financial Management 4