Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A CISO is preparing a presentation for the CFO to justify a new security awareness program. The CISO has quantified the benefits as $200,000 per year in reduced phishing incidents and $50,000 per year in reduced malware infections. The program costs $100,000 per year. The CFO is skeptical about the accuracy of the benefit estimates. What is the best way for the CISO to present the business case?

   • APresent only the ROI figure and emphasize that the benefits are based on industry benchmarks.
   • BPresent the payback period instead of ROI, since it is simpler to understand.
   • CPresent the ROI and also show a sensitivity analysis with conservative and optimistic benefit estimates.
   • DReduce the benefit estimates by 50% to be conservative, and present that ROI.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A CISO is evaluating a new multi-factor authentication (MFA) system. The CISO has identified the following: hardware token costs, reduced risk of account takeover, user productivity loss during rollout, and improved compliance with regulations. Which of these should be included as a cost in the cost-benefit analysis?

   • AHardware token costs and user productivity loss
   • BAll four items are costs
   • CHardware token costs only
   • DReduced risk of account takeover and improved compliance
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A CISO is presenting a business case for a new security tool. The initial ROI is 150%, but the CFO is concerned that the assumed 20% reduction in incident response time may be optimistic. The CISO has prepared a sensitivity analysis showing that ROI would be 80% if the reduction is only 10%. What is the best way to present this information?

   • APresent the 150% ROI and downplay the sensitivity analysis
   • BPresent both scenarios and explain the assumptions behind each
   • CPresent the 150% ROI as the primary figure and mention the 80% as a downside case
   • DPresent only the 80% ROI to be conservative
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the payback period of a security investment?

   • AThe total time the security solution will remain effective
   • BThe time between the identification of a risk and the implementation of a control
   • CThe period after which the investment starts generating a profit
   • DThe time required for the cumulative net benefits to equal the initial investment cost
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company is evaluating a security awareness training program. The program costs $120,000 per year, including staff time away from production. The CISO estimates that the program will reduce phishing-related incidents by 60%, avoiding an average of $180,000 per year in incident response costs and productivity losses. The CISO also expects a $30,000 annual reduction in regulatory fines due to fewer data breaches. What is the annual ROI for this investment?

   • A150%
   • B42%
   • C58%
   • D75%
   Reveal Solution Discussion Select an answer first