Choose a control portfolio, not a shopping list

When four controls seek funding, “all are important” is not a decision. Budget and delivery capacity are limited. Some controls interrupt the same attack path, so adding their stand-alone benefits double counts protection. A portfolio decision asks what each intervention changes in a named scenario, by how much under stated assumptions, which prerequisite it needs, and what risk remains when money or time runs out. Selecting a defensible portfolio does not mean accepting every unaddressed risk forever.

Begin with a baseline for each scenario rather than one overall score. For planning, a team might estimate **annual expected loss** by multiplying an estimated frequency by an estimated consequence. The product is still a model, not an observed fact, if either input rests on judgment. Show it with a plausible range and sensitivity test, and do not place it on a board dashboard without its assumptions. A day's service interruption and the cost of repairing systems may be different components, but they may also overlap; define the impact boundary to avoid counting the same harm twice. When monetary evidence is too weak, use service constraints and a documented qualitative trade-off instead of manufactured precision.

Measure **marginal benefit inside the selected portfolio**: the improvement after controls already selected, not the improvement a control promises on its own. If phishing-resistant authentication closes most of a stolen-administrator path, a second access control cannot claim the full stand-alone reduction from that same path. In contrast, an isolated backup may depend on a restoration exercise before its benefit is credible; an untested store may hold an image that cannot boot. That is a prerequisite relationship rather than benefit overlap. Mark “reinforces” and “requires” differently before solving a budget problem.

## Stress-test the preference

The model gives A+C+D a 450,000 improvement and B+C+D a 410,000 improvement, a 40,000 difference. If A has an omitted annual operating cost of 45,000, the financial comparison could reverse. If A's estimated 160,000 stand-alone effect assumes every administrator uses the new method, but 30% still have a legacy emergency path, the effect may be overstated. No invented “failure probability” is required to make this visible. Find the switch point: if S1's residual after A exceeds 180,000 instead of 140,000, A is no longer better than B on that modeled dimension. Implementation burden and other effects may still differ.

Do not collapse the recommendation to one annual total. S1 might have a lower average yet a worse tail impact on customer rights or trust. S2 could exceed a board-approved outage boundary even if its modeled monetary cost looks moderate. Return to the appetite and tolerance statements from the previous lesson. If one option crosses a binding organizational boundary, a lower aggregate expected loss may not make it acceptable. Report the residual for each scenario, not only “450,000 saved,” and show the uncertainty in both exposure and delivery before seeking approval.

## Turn the choice into a verified outcome

Approval of A+C+D does not close the risk record. Give each intervention an execution test. Check an authorized administrator login and a safe simulated phishing attempt to see whether the new authentication resists the intended path. Check that a production administrator cannot delete the isolated backup with the same identity. Restore an image into a clean environment and measure elapsed time and data integrity. Design tests so they do not damage a live service. If restoration fails, revise S2's residual estimate so it no longer assumes C worked. Order delivery accordingly: D defines the restore acceptance criteria, C is configured and tested against them, and A can proceed in parallel if the same scarce staff are not pulled from critical response work.

The decision record states rejected alternatives, the assumption that makes A preferable to B, the C-to-D dependency, who can accept residual risk, and when it is reviewed. After a quarter, compare actual administrator coverage and successful restores with the assumptions behind the benefit. If coverage has not been achieved, do not report theoretical savings as realized performance. Measure control operation before announcing risk reduction.

## Practice and reference answer

A fictional transport-booking service has a 90,000 budget. Its planning model estimates 300,000 of interruption impact and 160,000 of privilege misuse impact. Options are E, database monitoring, costing 30,000 and reducing modeled misuse to 110,000; F, a privilege review, costing 40,000 and reducing misuse to 80,000 alone but only to 70,000 after E; G, an isolated backup, costing 50,000 and reducing interruption to 120,000 after recovery test H succeeds; and H, a recovery test, costing 10,000 and reducing interruption to 260,000 alone. Select an initial portfolio, reject one tempting option, and name a test that could change your answer.

One defensible answer is E+G+H at 90,000. The conditional modeled residual is 110,000+120,000=230,000. F+G also costs 90,000, but it cannot legitimately claim G's 120,000 interruption residual because it leaves H unfunded. F+H costs 50,000 and leaves 80,000+260,000=340,000. E+F+H costs 80,000 and leaves 70,000+260,000=330,000. If H could genuinely be performed with a separately funded, available capability, the feasible set would change; do not call it free by assumption. Verify that E's monitoring can prompt a timely response and that G actually restores. A failed H invalidates the 120,000 estimate and requires a revised decision.