Annual staff parties

Only physical security controls

Increasing marketing budget

Regular data backups and offsite storage

It is the total cost of a cyber incident

It refers to the time required to notify stakeholders

It defines the point in time to which data must be recovered after an incident

It is the maximum downtime allowed for a service

The minimum time needed to detect a cyber incident

The total duration of a business impact analysis

The maximum acceptable amount of data loss measured in time

The maximum time allowed to restore a process after a disruption

It reduces the need for compliance

It eliminates the need for reporting

It increases the number of employees needed

It helps detect control failures early and minimize operational disruptions

Internal audits

Multi-factor authentication for online transactions

Disciplinary actions for policy violations

Monthly bank reconciliations

Detective Control

Preventive Control

Directive Control

Corrective Control

Monitoring Activities

Risk Assessment

Marketing Strategy

Control Activities

To automate all business processes

To manage risks and ensure compliance with regulatory standards

To eliminate the need for audits

To increase profits

It allows for the elimination of all manual processes

It restricts risk monitoring to annual reviews

It focuses only on external regulatory requirements

It ensures risk management strategies remain effective

Open communication and regular updates to all stakeholders

Using only automated systems for reporting

Limiting communication to board members

Focusing only on quantitative metrics