Information Security Programme practice questions

Penetration testing conducted by an external firm

External penetration testing is a purchased service, not a capital or software asset, so it belongs in the services budget category. The stem asks which components are services; the external firm's engagement fees are consumed as delivered rather than owned.

Managed Security Service Provider (MSSP) fees

MSSP fees are recurring payments for an outsourced monitoring and management service, placing them squarely in the services budget category. Unlike hardware or licences, no asset is owned; the organisation purchases ongoing capability, satisfying the stem's services classification.

Mature, as it aligns with the 10-15% benchmark

Spending 12% of the IT budget sits within the widely cited 10-15% benchmark for security investment, so the funding level itself indicates a mature, well-resourced programme rather than an immature one. The stem's specific 12% figure is the constraint that places it inside that benchmark range.

Phishing simulation click rate

Phishing simulation click rate measures user susceptibility before any real compromise, predicting future incident likelihood. It satisfies the stem's leading-indicator requirement because it reflects a controllable weakness that precedes breaches, unlike lagging metrics such as incident counts or MTTD, which record events after they occur.

Patch compliance percentage

Patch compliance percentage is a leading indicator because it measures preventive control coverage before incidents occur, signalling future breach likelihood. It satisfies the board's need for forward-looking metrics, unlike lagging indicators such as incident counts that only report past events.

Firewall, antivirus, encryption, and security awareness training

Layering a network firewall, host antivirus, data encryption and human-focused awareness training spans preventive, detective and administrative domains. Each control addresses different attack vectors, so failure of one layer does not expose the asset, exemplifying defence in depth.

$1 million to $1.5 million

Mature security programmes typically spend roughly 10-15% of the IT budget, so $1 million to $1.5 million against a $10 million IT budget falls squarely in that benchmark range. This satisfies the stem's mature-programme constraint, reflecting sustained investment in tooling, staff and governance.

Mean time to detect (MTTD)

MTTD is a lagging indicator: it measures elapsed time after incidents have already occurred, reporting historical detection performance. It cannot predict future risk, unlike leading indicators such as patch compliance or training completion rates that forecast control effectiveness.

CISO reports directly to the CEO or Board of Directors.

Direct CEO or board reporting removes the CIO filter, giving the CISO organisational independence and a mandate to weigh business risk alongside IT priorities. This satisfies the stem's concern about IT-centric decisions by elevating security to enterprise governance rather than a technology sub-function.

Phishing click rate and mean time to detect (MTTD)

Phishing click rate is a leading indicator, predicting future compromise likelihood, while MTTD is lagging, measuring detection performance after incidents occur. Pairing them satisfies the stem's requirement for both types, giving the C-suite forward-looking risk exposure alongside operational response capability.

Nth-party risk

Nth-party risk arises when a vendor subcontracts processing to further parties without disclosure, extending exposure beyond the directly contracted relationship. The undisclosed subcontractor sits downstream of the critical vendor, satisfying the scenario's fourth-party dependency condition.

Web application firewall (WAF), input validation, and security awareness training

Layering a WAF, input validation and awareness training spans network, application and human tiers, satisfying defence in depth. Each control targets a different attack vector, so a single bypass does not defeat the whole protection stack.

Show that the budget is below the industry benchmark of 0.2-0.5% of revenue and detail the risks of underfunding.

Benchmarking against the 0.2–0.5% industry range frames the shortfall in terms the board understands, quantifying underinvestment relative to peers. Pairing this with specific risk exposure from underfunding converts an abstract budget request into a defensible business case.

Ongoing monitoring

Ongoing monitoring sustains visibility after onboarding, tracking vendor risk posture, breaches, subprocessor changes and control drift throughout the relationship. This satisfies the stem's comprehensive-programme requirement by ensuring third-party risk is managed continuously rather than treated as a one-off contractual checkpoint.

Onboarding risk assessment

Onboarding risk assessment evaluates a vendor's controls, data access and inherent risk before contracts are signed, informing tiering and due diligence depth. This satisfies the stem's comprehensive-programme requirement by establishing a risk baseline at the point of engagement, before any data or system access is granted.

Annual reassessment

Annual reassessment revalidates vendor risk posture at defined intervals, catching control decay, ownership changes and evolving threat exposure. This satisfies the stem's comprehensive-programme requirement by providing scheduled, documented review that complements continuous monitoring and keeps tiering and remediation decisions current.

Phishing click rate

Phishing click rate is a leading indicator because it measures user susceptibility before an actual breach occurs, directly evidencing whether awareness training is changing behaviour. It satisfies the stem's requirement for predictive measurement of programme effectiveness, unlike lagging indicators such as incident counts that only report realised harm.

Phishing click rate and mean time to detect (MTTD)

Phishing click rate is a leading indicator of user-driven risk, while MTTD is a lagging indicator of detection capability. Combining them satisfies the stem's balanced-view requirement, showing both predictive exposure and realised operational performance rather than only historical incident counts.

Phishing click rate and patch compliance percentage

Combining phishing click rate with patch compliance gives the board two concise, business-readable measures covering human and technical exposure. This satisfies the one-page, high-level constraint by summarising status without operational detail, enabling directors to judge risk posture and trend rather than raw vulnerability counts.

Access review completion rate

Access review completion rate measures how consistently entitlement checks are performed, predicting whether excessive or stale permissions will be caught before misuse. Unlike breach counts or incident volumes, it reflects preventive control activity, making it a forward-looking indicator of programme effectiveness.

Tier 2 SOC analyst

Tier 2 analysts perform deep alert triage and correlation, escalating confirmed incidents to Tier 3 or response teams. Tier 1 handles initial monitoring and basic filtering, so Tier 2 satisfies the stem's requirement to determine whether alerts represent actual security incidents.

Implement a compensating control that provides equivalent protection

A compensating control delivers equivalent protection through an alternative mechanism when the prescribed ISO 27001 Annex A control is unaffordable, satisfying the cost-prohibitive constraint while still treating the high-impact breach risk. Simply accepting or avoiding the risk would leave that exposure unmitigated, which is unacceptable at high impact.

Patch compliance percentage

Patch compliance percentage measures the proportion of systems currently patched, predicting future compromise likelihood rather than reporting past incidents. It satisfies the leading-indicator constraint because it forecasts exposure before exploitation occurs, unlike lagging metrics such as breach counts.

Phishing click rate

Phishing click rate quantifies how often users fail simulated lures, exposing human-risk trends that predict future credential compromise. It satisfies the leading-indicator constraint because it measures susceptibility before an actual breach, unlike lagging metrics such as confirmed incident counts.

Phishing click rate

Phishing click rate is a leading indicator because it predicts future compromise likelihood by measuring current user behaviour, rather than reporting incidents already realised. It therefore evidences whether the security programme is reducing human risk before losses occur, satisfying the stem's predictive-effectiveness requirement.