Risk Mitigation Strategies & Controls Flashcards

A bank implements a policy requiring dual authorization for all wire transfers above $50,000. Which control type does this represent?

Answer: Preventive control

Dual authorization is a preventive control because it stops unauthorized transactions before they occur.

Which risk mitigation strategy is most appropriate when the cost of control implementation exceeds the expected loss from the risk?

Answer: Risk acceptance

Risk acceptance is chosen when mitigation costs outweigh the potential financial impact of the risk.

An organization purchases cyber liability insurance to offset potential data breach losses. This is an example of:

Answer: Risk transfer

Insurance shifts the financial burden of a risk event to a third party, making it a risk transfer strategy.

Which of the following best describes a compensating control?

Answer: An alternative control used when the primary control is not feasible

Compensating controls serve as substitutes when primary controls cannot be implemented due to technical or business constraints.

In the NIST Risk Management Framework, which step involves selecting and implementing security controls?

Answer: Implement

The Implement step in NIST RMF focuses on putting chosen security controls into practice within the information system.

A company decides to exit a high-risk product line because the inherent risk cannot be economically controlled. This is an example of:

Answer: Risk avoidance

Risk avoidance involves eliminating the activity that creates the risk exposure entirely.

Which metric best measures the effectiveness of risk mitigation controls over time?

Answer: Key Risk Indicator (KRI) trend analysis

KRI trend analysis tracks changes in risk levels over time, directly reflecting whether mitigation efforts are reducing exposure.