Develop strategic thinking. This simulation tests your ability to make executive-level governance decisions balancing risk, compliance, and business objectives.
You are the Chief Information Security Officer (CISO) for Apex Financial Services. During a routine internal review, your security architecture team discovers a massive blind spot: the primary Data Loss Prevention (DLP) control is entirely ineffective at inspecting encrypted outbound traffic to external cloud storage providers.
Apex Financial Services is preparing for an aggressive expansion into the European market, which means the organization will soon be subject to stringent GDPR regulatory requirements. The organization’s risk tolerance for data exfiltration is extremely low. However, you are currently in Q4, budgets are locked, and requesting emergency capital expenditure requires substantial business justification.
The discovery of the failing DLP control has caused panic among operational leaders.
Before spending unbudgeted capital or burning political capital with the IT department, you must determine the most defensible next step according to established security governance frameworks.
A missing/ineffective security control is identified. Which of the following should be the NEXT step?
A control is failing, leading to a reactionary mindset among stakeholders. The core problem is not just the technical failure, but the lack of understanding of what this failure actually means to the business. Fixing a control blindly can result in over-investing in low-risk areas or ignoring more critical systemic issues.
IT operational leaders often default to immediately fixing broken technical components (Option B). However, executive leadership views security through the lens of risk and cost. The Board does not care that a tool is broken; they care about the residual risk exposure resulting from that broken tool.
If you immediately demand $250,000 for an SSL decryption tool without assessing the risk, you might later discover that compensating controls (e.g., endpoint restrictions, strict cloud access policies) already mitigate the threat. This severely damages your credibility as a business-aligned CISO.
C. Perform a risk assessment to measure risk is the mandatory next step in the GRC lifecycle. When a gap is identified, you must immediately quantify the resulting residual risk. How severe is the exposure? What is the likelihood of exploitation? Are there compensating controls? Only after measuring the risk can you determine if the issue requires immediate escalation, capital expenditure, or simply acceptance.