Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
In the context of information security and risk management, a cost-benefit analysis is a fundamental tool for making rational, financially sound decisions. The core principle is that the cost of protecting an asset should not be greater than the potential loss from a security incident affecting that asset. This is often framed by the formula: Cost of Control < Annualized Loss Expectancy (ALE)
Performing a cost-benefit analysis when implementing a security control is crucial to ensure that the cost of the mitigation effort does not exceed the value of the asset being protected. This approach ensures that the resources spent on security controls are justified by the value of the asset and the potential risk reduction. It helps organizations allocate their security budget more effectively and avoid overspending on controls that do not provide sufficient benefits relative to their costs.
I’m going with B. My reason is that A is included in B. And if there is no risk to the business, then, mitigating, it is pointless.