CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
An organization has implemented a new data loss prevention (DLP) solution to monitor and block sensitive data from leaving the corporate network. As part of control monitoring, the risk practitioner regularly reviews logs and alerts generated by the DLP system and finds that 95% of the alerts are false positives. While the DLP system technically blocks data, the high volume of false positives renders the system ineffective in practice, as legitimate business operations are frequently disrupted, and security analysts are overwhelmed. This scenario primarily indicates a failure in which aspect of the control?
- AControl ownership
- BControl cost-benefit analysis
- CControl documentation
- DControl design effectiveness
Show answer & explanationAnswer & explanation
Correct answer: D. Control design effectiveness
Control design effectiveness refers to whether a control, if operating as prescribed, can prevent, detect, or correct a risk. Although the DLP technically blocks data, its high false positive rate demonstrates that its design is flawed, making it impractical and ineffective in achieving its intended objective without undue burden or disruption.
Why the other options are wrong
- A. Control ownership refers to accountability for the control, which isn't the problem; the control itself isn't working as intended.
- B. While cost-benefit is related, the immediate problem is the control's practical utility due to its design, not primarily its cost justification.
- C. Control documentation refers to how well the control is described, which is not the issue here.
Control Design Effectiveness
Control design effectiveness evaluates whether a control, if implemented and operating as intended, is capable of preventing, detecting, or correcting the identified risk without causing undue burden or disruption.
- Focuses on the control's theoretical ability to meet its objective.
- Considers practicality and efficiency.
- Distinct from operational effectiveness, which assesses how well it actually works in practice.
Memory trick: Design is the Blueprint; Operation is the Building.