Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Tessen Retail is expanding its online shop and wants a structured approach to cyber risk. Management proposes: identify information assets, identify threats and vulnerabilities, assess likelihood and impact, then select controls proportionate to the assessed risk. Which statement best describes the implication of this approach?

A risk-based approach directs security spending to the assets and threats with the highest assessed exposure, based on likelihood and impact. It does not treat all assets equally, does not guarantee against breaches, and must be reviewed regularly as threats and the business change.

  1. AControls will be applied equally to all assets so that no asset is treated as more important than another
  2. BSecurity spending will be prioritised towards the assets and threats where assessed risk exposure is highestCorrect
  3. CThe approach guarantees that no breach will occur once controls are selected
  4. DRisk assessment should be performed once, at implementation, and not repeated unless a breach occurs

Explanation

A risk-based approach ranks exposures by likelihood and impact so resources go to the highest risks. Equal treatment ignores differing asset value. No framework guarantees prevention, and risk assessment must be repeated as threats and the business change.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions