IIBA Cybersecurity Analysis IIBA-CCA New Questions

In cybersecurity risk management,risk treatmentis the set of actions used to reduce risk to an acceptable level. The most common tool used to directly treat or mitigate cyber risk is acontrolbecause controls are the specific safeguards that prevent, detect, or correct adverse events. Cybersecurity frameworks describe controls as measures implemented to reduce either thelikelihoodof a threat event occurring or theimpactif it does occur. Controls can be technical (such as multifactor authentication, encryption, endpoint protection, network segmentation, logging and monitoring), administrative (policies, standards, training, access approvals, change management), or physical (badges, locks, facility protections). Regardless of type, controls are the direct mechanism used to mitigate identified risks.

Anexit strategyis typically a vendor or outsourcing risk management concept focused on how to transition away from a provider or system; it supports resilience but is not the primary tool for directly mitigating a specific cyber risk.Standardsguide consistency by defining required practices and configurations, but the standard itself is not the mitigation—controls implemented to meet the standard are. Abusiness continuity plansupports availability and recovery after disruption, which is important, but it primarily addresses continuity and recovery rather than directly reducing the underlying cybersecurity risk in normal operations. Therefore, the best answer is the one that represents the direct implementation of safeguards:controls.

Unauthorized access to data is the defining condition of a data breach. In standard cybersecurity terminology, a breach occurs when confidentiality is compromised—meaning data is accessed, acquired, viewed, or exfiltrated by an entity that is not authorized to do so. This is distinct from a “threat,” which is only the potential for harm, and distinct from a “hacker,” which describes an actor rather than the security outcome. A breach can result from external attackers, malicious insiders, credential theft, misconfigurations, unpatched vulnerabilities, or poor access controls. Cybersecurity guidance typically frames breaches as realized security incidents with measurable impact: exposure of regulated data, loss of intellectual property, fraud risk, reputational harm, and legal/regulatory consequences. Once unauthorized access is confirmed, incident response procedures generally require containment (limit further access), preservation of evidence (logs, system images where appropriate), eradication (remove persistence), and recovery (restore secure operations). Organizations also assess scope—what data types were accessed, how many records, which systems, and the dwell time—and then determine notification obligations where laws or contracts apply. In short, the discovery describes an actual compromise of data confidentiality, which is precisely a breach.

Multiple sources that can harm an organization’s systems are classified as threats. In cybersecurity risk terminology, a threat is any circumstance, event, actor, or condition with the potential to adversely impact confidentiality, integrity, or availability. Threats can be human (external attackers, insiders, third-party compromises), technical (malware, ransomware campaigns, exploit kits), operational (misconfigurations, weak processes, inadequate monitoring), or environmental (power disruption, natural disasters). This differs from a breach, which is the realized outcome where unauthorized access or disclosure has already occurred. It also differs from hacker, which refers to one type of threat actor rather than the broader category of potential harm. Ransomware is a specific threat type (malware that encrypts data and demands payment), not a general term for multiple sources of harm. Cybersecurity documents commonly pair “threats” with “vulnerabilities” and “controls”: threats exploit vulnerabilities to create risk; controls reduce either the likelihood of exploitation or the impact if exploitation occurs. Identifying “multiple sources which can harm systems” is essentially threat identification—an early and ongoing step in risk management used to inform security architecture, monitoring, and incident preparedness. Therefore, the correct concept is threat.

Functional security requirements definewhat security capabilities a system must provideto protect information and enforce policy. They describe required security functions such as identification and authentication, authorization, role-based access control, privilege management, session handling, auditing/logging, segregation of duties, and account lifecycle processes. Because of this,user privilegesare a direct and core concern of functional security requirements: the system must support controlling who can access what, under which conditions, and with what level of permission.

In cybersecurity requirement documentation, “privileges” include permission assignment (roles, groups, entitlements), enforcement of least privilege, privileged access restrictions, elevation workflows, administrative boundaries, and the ability to review and revoke permissions. These are functional because they require specific system behaviors and features—for example, the ability to define roles, prevent unauthorized actions, log privileged activities, and enforce timeouts or re-authentication for sensitive operations.

The other options are typically classified differently.System reliabilityandperformance/stabilityare generally non-functional requirements (quality attributes) describing service levels, resilience, and operational characteristics rather than security functions.Identified vulnerabilitiesare findings from assessments that drive remediation work and risk treatment; they inform security improvements but are not themselves functional requirements. Therefore, the option best aligned with functional security requirements is user privileges.