Pass the IIBA Cybersecurity Analysis IIBA-CCA Questions and answers with CertsForce

A cybersecurity infrastructure business case is typically driven by theRiskfunction because the justification for security investments is grounded in reducing enterprise risk to an acceptable level and aligning with the organization’s risk appetite and regulatory obligations. Risk-focused teams (often working with the CISO and security governance) translate threats, vulnerabilities, and control gaps into business impact terms such as likelihood of adverse events, potential operational disruption, financial exposure, regulatory penalties, and reputational harm. This framing is what a formal business case requires: a clear problem statement, quantified or prioritized risk scenarios, expected risk reduction from proposed controls, and how residual risk compares to tolerance thresholds.

WhileITusually leads implementation and provides architecture, sizing, and operational cost estimates, IT alone does not typically “drive” the business case without the risk rationale that explains why the investment is necessary and what enterprise outcomes it protects.Legalcontributes requirements related to compliance, contracts, and breach handling, but it generally supports rather than owns investment prioritization.Financeevaluates budgeting, funding options, and return-on-investment assumptions, yet it relies on risk inputs to understand why the spend is warranted and what loss exposure is being reduced.

Therefore, the organizational area most responsible for driving a cybersecurity infrastructure business case—by defining the risk problem, articulating risk-based benefits, and enabling executive decision-making—isRisk.

Bottom of Form

Risk managers demonstrate the effectiveness of security controls by usingmetrics reportingbecause metrics provide objective, repeatable evidence that controls are operating as intended and are producing measurable outcomes. In cybersecurity governance, “control effectiveness” is shown through performance indicators and trend data, not just by stating that a control exists. Metrics translate technical activity into risk-relevant results that leadership can understand and act on.

Common control-effectiveness metrics include patch compliance rates and time-to-remediate critical vulnerabilities, percentage of systems meeting secure configuration baselines, multifactor authentication coverage, privileged access review completion rates, mean time to detect and respond, incident volume and severity trends, phishing simulation outcomes, and the percentage of logs successfully collected and retained for monitoring. Risk managers also use key risk indicators to track whether residual risk is increasing or decreasing, and they compare results against defined thresholds and risk appetite.

Whilepenetration testingcan validate exposure and reveal weaknesses, it is periodic and scenario-based; it does not continuously demonstrate ongoing control performance across the environment.Change managementis essential for stability and risk reduction, but it is a process control rather than a reporting practice used to demonstrate effectiveness.Security awareness trainingimproves user behavior, yet effectiveness still needs measurement through metrics such as completion rates and simulated phishing results. Therefore, metrics reporting is the operational practice most directly used to demonstrate control effectiveness.