At Alder Quay Logistics, a shared customer export store supports dispatch and billing. A contractor's account remains active after departure, recovery tests are overdue, and the operations director calls every spreadsheet row a high risk. The security analyst must turn those concerns into decisions before the next supplier review.
Your assessment covers the customer export service and its dependencies over the next twelve months. Separate business consequences from technical weaknesses, explain scoring assumptions, and record who can authorize the remaining exposure. A completed register is a decision record, not proof that controls work.
Inventory assets before assigning importance
An asset is something of value: data, software, infrastructure, people, or a business service. An inventory should identify each asset, its business purpose, accountable owner, location, dependencies, and lifecycle state. For the export service, include customer contact records, storage, access identities, the dispatch integration, and recovery copies. An abandoned account is easy to miss if the inventory lists only servers.
Classification describes required handling; criticality describes the consequence of loss or disruption. Alder Quay labels customer records confidential because disclosure affects customers, while dispatch availability is operationally critical because a four-hour outage delays deliveries. Confidentiality, integrity, and availability can have different priorities for the same asset. A public route timetable may be public in classification yet critical to operations.
Use agreed classification criteria and an owner who understands the business. An auditor may sample a data flow and ask whether its inventory entry, handling rules, retention, and dependencies agree. Common mistakes include copying a default label onto every asset, treating purchase price as total business value, and forgetting outsourced services or backup copies.
Identify scenarios, not just weaknesses
A threat is a potential cause of harm; a vulnerability is a weakness that enables harm. Risk concerns uncertainty about an event and its consequences for objectives. Write a scenario connecting asset, threat event, enabling condition, and business impact: a former contractor uses an unrevoked account to download customer exports, causing disclosure, investigation costs, and contractual notification work. 'Weak access' alone is not a usable scenario.
Find scenarios through process interviews, incident history, dependency mapping, access reviews, and recovery exercises. Record the source and assumptions: the contractor account can read the store, exports contain personal contact details, and access logs cover only thirty days. Distinguish a confirmed incident from future exposure; incident evidence can inform likelihood without making every future event certain.
Avoid listing the same disclosure scenario once per missing safeguard unless the causes or treatment decisions differ materially. Also avoid combining disclosure and multi-day disruption into a vague mega-risk: their consequences and owners may differ. An auditor asks what evidence supports the event pathway and whether important dependencies and business objectives were considered, not merely how many rows exist.
A useful scenario connects a valued asset, an event pathway, and a business consequence.
Score consistently with a qualitative 5 by 5 matrix
Agree scales before rating. For this room's twelve-month horizon, likelihood is 1 rare (at most 5% chance), 2 unlikely (over 5% to 20%), 3 possible (over 20% to 50%), 4 likely (over 50% to 80%), or 5 almost certain (over 80%). Impact is 1 negligible, 2 minor, 3 moderate, 4 major, or 5 severe. Here the financial anchors are below $5,000; $5,000 to below $25,000; $25,000 to below $100,000; $100,000 to below $500,000; and $500,000 or more. Use the highest applicable rating across financial, operational, legal, and customer criteria, defined before scoring.
The export-disclosure scenario has likelihood 4 based on repeated unauthorized access attempts and impact 4 based on an estimated $150,000 consequence. Multiply the ordinal ratings: 4 × 4 = 16. Alder Quay defines 1-4 low, 5-9 medium, 10-16 high, and 17-25 critical. Thus 16 is high, not critical. These bands are local policy, not a universal standard. Record the rationale and evidence date, not just the red cell.
Ordinal scores prioritize discussion; 16 does not mean twice the expected loss of 8. Two scenarios scoring 12 may need different decisions if one threatens safety or a legal obligation. Calibrate ratings across teams, document uncertainty, and escalate mandatory obligations regardless of color. An auditor asks whether assessors used the same horizon, anchors, and band boundaries and whether overrides were justified.
Estimate monetary exposure without false precision
Single loss expectancy (SLE) estimates the financial loss from one event. In a simplified asset model, SLE = asset value × exposure factor, where the exposure factor is the fraction lost per event. If recoverable records and associated business costs are valued at $200,000 and an event loses 25% of that value, SLE = $200,000 × 0.25 = $50,000. Define what the valuation includes to avoid counting recovery costs twice.
Annualized rate of occurrence (ARO) is expected events per year, not an impact rating. An event expected once every four years has ARO 0.25. Annualized loss expectancy (ALE) = SLE × ARO = $50,000 × 0.25 = $12,500 per year. ARO can exceed 1 for repeated events. ALE is a long-run planning estimate, not a prediction that precisely $12,500 will be lost next year, and it is not the 5×5 score converted to currency.
Suppose a safeguard lowers ARO from 0.25 to 0.10 without changing SLE: the estimated ALE becomes $5,000, a reduction of $7,500 annually. Compare that with a $6,000 annualized safeguard cost, but also consider uncertainty, tail losses, and obligations; the $1,500 expected net benefit is not a guarantee. Document ranges and sources when event data is sparse. Auditors ask how occurrence estimates and loss components were derived rather than accepting precise-looking multiplication as evidence.
Choose treatment and distinguish accountability
Accept means explicitly retain exposure within authorized limits; it is not forgetting a row. Mitigate means reduce likelihood or impact through controls. Transfer means allocate some financial or contractual consequence through insurance or agreements; exclusions and retained obligations remain. Avoid means stop the activity that creates the exposure, such as ending customer exports entirely. Outsourcing storage is not automatically avoidance, and buying insurance does not prevent disclosure.
The risk owner is accountable for the business exposure and treatment decision within delegated authority. The control owner operates or maintains a particular safeguard. The operations director owns dispatch exposure; the identity administrator owns the access-review control. One person can hold both roles, but the roles are not interchangeable. A control operator cannot authorize a high residual exposure merely because they implemented the fix.
Inherent risk is assessed before controls under a stated baseline. Residual risk remains after controls; distinguish current residual risk supported by operating evidence from target residual risk dependent on planned work. For the export example, inherent 4 × 4 = 16 becomes current residual 2 × 4 = 8 after tested account removal and recurring access reviews. Impact remains 4 because disclosure would still be costly. A planned tool alone cannot justify that reduction. The owner must authorize the remaining exposure under policy or escalate it.
Controls change supported exposure estimates; the business owner decides and review keeps the decision current.
Maintain a register that supports decisions
A useful register includes a unique ID, asset and objective, scenario and cause, evidence source, assessment date and horizon, inherent likelihood/impact/score with rationale, existing controls and evidence, current residual ratings, risk owner, treatment choice, control or action owner, actions and due dates, target residual ratings, status, decision authority, acceptance rationale and expiry, and next review date. Link related incidents and control tests instead of copying sensitive evidence into unrestricted cells.
For AQ-17, record the operations director as risk owner, the identity administrator as control owner, mitigation by account removal and access reviews, test evidence dated 1 June, inherent 16, current residual 8, and an authorized decision on that remaining exposure. A future automation action can stay open without erasing the current risk. Close a treatment action when verified; close or retire a risk only with documented justification, not because the project budget ended.
Alder Quay reviews high and critical risks monthly and other active risks quarterly, with earlier reassessment after incidents, failed controls, supplier changes, new data, or major process changes. Acceptance expires on its recorded date and requires renewed authority. Auditors look for overdue actions, expired decisions, and ratings that respond to evidence. Frequent mistakes are ownerless rows, identical unexplained scores, confusing planned controls with existing ones, treating transfer as zero risk, and leaving review dates unchanged after a material event.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The spreadsheet calls everything a threat
Scenario sim+50 XP
Resolve the two mislabelled concepts.
Incident brief
An analyst labels an unrevoked contractor account a 'threat' and labels possible misuse by a former contractor a 'vulnerability.' The store's customer records are marked confidential, so the director insists their availability cannot be critical. Focus on the account weakness and the event source, not the classification distraction.
Term bank, not all of these are right
vulnerabilitythreatimpactclassification
1.1What term describes the unrevoked account weakness? (one word)
1.2What term describes the potential cause of harm from the former contractor? (one word)
Task 2: The annual number that is not annual
Scenario sim+50 XP
Name the correct quantities using their full terms.
Incident brief
Finance estimates $50,000 loss per event and one event every four years. A manager calls $50,000 the annualized loss expectancy and calls 0.25 an impact score. Another analyst calculates $12,500 per year and claims it is guaranteed spending next year.
Term bank, not all of these are right
single loss expectancyannualized loss expectancyannualized rate of occurrenceimpact score
2.1What is the correct name for the $50,000 per-event estimate? (three words)
2.2What is the correct name for the $12,500 yearly planning estimate? (three words)
Task 3: The administrator signs away the exposure
Scenario sim+50 XP
Identify the accountable role and the remaining exposure.
Incident brief
After tested access controls reduce likelihood from 4 to 2 while impact stays 4, an administrator calls the remaining score of 8 'inherent risk' and signs acceptance because they maintain the controls. Policy delegates acceptance of this business exposure to the operations director, not the administrator.
Term bank, not all of these are right
risk ownerresidual riskcontrol ownerinherent risk
3.1Which role must make the business exposure decision here? (two words)
3.2What is the exposure remaining after the tested controls called? (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Build the decision fields for AQ-17 from the fixed requirements. The reviewer has already approved the scenario narrative and evidence links; this exercise checks the structured fields, not the completeness of a real register.
Controls have been tested. Do not substitute the planned target for the current residual estimate, or assign business acceptance to the person running the safeguard.
AQ-17 mandatory register fields
asset_id: exports-01
classification: confidential
scenario: Former contractor uses an unrevoked account to download customer exports, causing disclosure.
inherent: likelihood 4, impact 4, score 16
existing_controls: account removal and recurring access review; operating test passed 2026-06-01
current_residual: likelihood 2, impact 4, score 8
risk_owner: operations director
control_owner: identity administrator
treatment: mitigate
review: quarterly (every 3 months) for current medium residual risk; reassess on material change
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Checks
Identify and classify the asset
Record the pre-control assessment
Use the tested current exposure
Separate business and safeguard accountability
Declare treatment and routine and triggered review
Assess six independent claims against the baseline: use event frequency for ALE, require operating evidence for current residual reductions, retain business acceptance authority, and do not treat transfer as elimination.
Reject each defective claim using its single closest reason code. Accept the two claims that demonstrate their stated decision; do not infer facts from neighboring rows.
Verdicts are accept or reject. Every rejection needs one reason code from: ale-calculation | unsupported-residual | wrong-authority | transfer-not-elimination.
Independent committee claims
RA-1 | SLE is $50,000 and ARO is 0.25. Finance reports ALE as $200,000 by dividing SLE by ARO.
RA-2 | An access control is only planned. The register lowers current residual likelihood now, with no operating evidence.
RA-3 | Policy reserves acceptance to the operations director. The identity administrator accepts business exposure solely because they operate access reviews.
RA-4 | Insurance covers some response costs. The register declares zero remaining disclosure risk solely because the policy was purchased.
RA-5 | Tested account removal reduces likelihood from 4 to 2; impact remains 4. The entry records current residual score 8 and links dated operating evidence.
RA-6 | An authorized owner accepts a medium exposure within delegated limits, records rationale and expiry, schedules quarterly review, and requires earlier review after material change.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Laws, Regulations and Obligations
Determine which obligations apply, distinguish legal duties from promises, and trace requirements to controls and evidence.
