MENU
Scenario 5:
Crestview University is a well-known academic institution that recently launched a digital learning platform to support remote education. The platform integrates video lectures, interactive assessments, and student data management. After initial deployment, the risk management team identified several key risks, including unauthorized access to research data, system outages, and data privacy concerns.
To address these, the team discussed multiple risk treatment options. They considered limiting the platform's functionality, but this conflicted with the university's goals. Instead, they chose to partner with a reputable cybersecurity firm and purchase cyber insurance. They also planned to reduce the likelihood of system outages by upgrading server capacity and implementing redundant systems. Some risks, such as occasional minor software glitches, were retained after careful evaluation because they did not significantly affect Crestview's operations. The team considered these risks manageable and agreed to monitor and address them at a later stage. Thus, they documented the accepted risks and decided not to inform any stakeholder at this time.
Once the treatment options were selected, Crestview's risk management team developed a detailed risk treatment plan. They prioritized actions based on which processes carried the highest risk, ensuring cybersecurity measures were addressed first. The plan clearly defined the responsibilities of team members for approving and implementing treatments and identified the resources required, including budget and personnel. To maintain oversight, performance indicators and monitoring schedules were established, and regular progress updates were communicated to the university's top management.
Throughout the risk management process, all activities and decisions were thoroughly documented and communicated through formal channels. This ensured clear communication across departments, supported decision-making, enabled continuous improvement in risk management, and fostered transparency and accountability among stakeholders who manage and oversee risks. Special care was taken to communicate the results of the risk assessment, including any limitations in data or methods, the degree of uncertainty, and the level of confidence in findings. The reporting avoided overstating certainty and included quantifiable measures in appropriate, clearly defined units. Using standardized templates helped streamline documentation, while updates, such as changes to risk treatments, emerging risks, or shifting priorities, were routinely reflected in the system to keep the records current.
Through this methodical and transparent approach, Crestview University ensured that its digital learning platform was supported by a resilient, well-documented, and continuously improving risk management process.
Based on the scenario above, answer the following question:
Which risk treatment option did Crestview University select to address cybersecurity risks?
The correct answer is B. Risk sharing by outsourcing and insurance. ISO 31000:2018 identifies several risk treatment options, including risk avoidance, risk reduction, risk sharing, and risk retention. Risk sharing involves transferring or sharing part of the risk with another party, such as through outsourcing arrangements or insurance contracts.
In Scenario 5, Crestview University deliberately chose not to avoid the risk by limiting the platform's functionality, as this conflicted with strategic and operational objectives. Instead, they partnered with a reputable cybersecurity firm and purchased cyber insurance. These actions clearly represent risk sharing, as the organization transferred part of the cybersecurity risk to external specialists and insurers while retaining overall accountability.
Risk reduction was also applied for system outages through server upgrades and redundancy, but the specific question focuses on cybersecurity risks, which were addressed through outsourcing expertise and insurance coverage. Risk retention applied only to minor software glitches, which were explicitly described as manageable and monitored.
From a PECB ISO 31000 Lead Risk Manager perspective, selecting risk sharing for high-impact, specialized risks such as cybersecurity is appropriate when external parties can manage the risk more effectively. Therefore, the correct answer is risk sharing by outsourcing and insurance.