Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank estimates that a phishing-led breach has an annual probability of 8% and a loss of USD 25 million if it occurs. A proposed control package of multifactor authentication and training costs USD 0.9 million per year and is expected to cut the probability to 3% with the loss severity unchanged. What is the net annual benefit of the package?

The net annual benefit is USD 0.35 million. Expected loss falls from 2.0 million (8% of 25 million) to 0.75 million (3%), a reduction of 1.25 million, and subtracting the 0.9 million annual control cost leaves 0.35 million.

  1. AUSD 0.35 millionCorrect
  2. BUSD 1.25 million
  3. CUSD 0.9 million
  4. DUSD 1.1 million

Explanation

Expected loss before = 0.08 x 25 = 2.0 million. After = 0.03 x 25 = 0.75 million. Reduction = 1.25 million. Net of cost 0.9 million = 0.35 million. The 1.25 million option ignores the control cost.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions