Skip to content

ACCA Strategic Professional · Strategic Business Leader · Cloud, mobile and smart technology

Harbour Court Hotels deploys smart room devices that connect to the hotel network. An internal review finds that many devices run default passwords and cannot be updated. From a risk perspective, which is the most appropriate first governance response?

The best response is to bring the devices into the formal risk register and apply security controls such as unique credentials, network segmentation and patching, with board oversight. This mitigates the exposure proportionately while retaining the benefits; ignoring, abandoning or fully outsourcing the risk would be inappropriate.

  1. AAccept the risk, since guests rarely notice device failures
  2. BRemove all IoT devices permanently and revert to manual room controls
  3. CInclude IoT devices in the IT risk register and enforce security standards such as unique credentials, network segmentation and patch management, with board-level oversightCorrect
  4. DTransfer all responsibility to the device suppliers through the purchase contracts

Explanation

Unsecured IoT endpoints widen the attack surface, so they should be identified, assessed and mitigated within the risk framework. Segmentation and credential controls reduce the risk proportionately while keeping the benefits. Permanent removal is excessive, acceptance ignores the exposure, and accountability cannot be wholly transferred by contract.

Did you get it right without looking?

One question tells you little. A timed set on Cloud, mobile and smart technology shows your real accuracy, how long you take and where you lose marks.

Practise Cloud, mobile and smart technologyFree diagnostic mock

More Cloud, mobile and smart technology questions