Model Response: The scale is qualitative. Low, medium, high, and severe are descriptive levels, not numeric or monetary scores — that is the CED’s own example of a qualitative result (2.1.D.6). Either scale is acceptable, so the auditor is not objecting to the scale itself. What is missing is the analysis behind the rating: EK 2.1.D.7 requires each asset’s specific vulnerabilities, how an adversary would exploit them, and the likelihood and severity of a compromise. The draft names threats but never connects a named vulnerability to an exploitation path.

A complete member-database entry would state the asset and its value to Riverbend and to an adversary; the specific vulnerabilities (for example, database credentials stored in an application config file, and no alerting on bulk export queries); how each would be exploited; the likelihood, argued from adversary motivation and capability and from how much skill the exploit requires (2.1.D.4); the severity, argued from restoration cost, regulatory penalties, and member harm (2.1.D.5); and only then the rating.

A bare rating cannot guide spending because two assets rated “high” can need completely different controls. Without the vulnerability and the exploitation path, leadership cannot tell whether the money should buy segmentation, monitoring, staff training, or a vendor change — so the rating tells them to act but not what to buy.

Model Response: Finding A was handled by avoidance — the activity generating the risk was stopped outright (2.1.E.2). Finding B was handled by transference — an insurance policy places the burden of the loss on another entity (2.1.E.3).

The strategies are not interchangeable. Avoidance was available for Finding A only because guest Wi-Fi is not critical to the mission; EK 2.1.E.2 states that avoidance is impossible when the activity is a critical part of the organization’s mission, which is exactly the case for core account processing. Running the argument the other way, transference would have been a poor answer for Finding A: paying an insurer to absorb a loss Riverbend could remove for free, by turning off a courtesy service, spends money to keep a risk it never had to hold.

Residual risk is what is left after the chosen strategy is applied. Insurance reimburses notification and legal costs; it does not stop the breach, restore member trust, or recover the exposed data, so Riverbend still carries the operational and reputational loss. Even after avoidance, members now use cellular data in the lobby and staff may be tempted to re-enable a hotspot. Acceptance means leadership has looked at that remaining exposure, judged it tolerable against the cost of reducing it further, and recorded that judgment with a date and an owner (2.1.E.4). Doing nothing is not acceptance — it is an undocumented risk that nobody has agreed to carry and nobody is monitoring.

Model Response: The badge-controlled door is a physical control and functions preventatively — it stops unauthorized entry before it happens. Phishing-awareness training is a managerial control, also preventative; it is easy to misfile as technical because it concerns computer use, but training is a process the organization runs, not a technology setting. Network segmentation is a technical control, preventative, because it removes a path an adversary would otherwise use. The incident response plan is the one most often misclassified: it is managerial, and its function is corrective, because it exists to help restore systems to an operational state after an incident rather than to stop one.

The consultant is wrong. Encryption is a single technical control protecting one property of one asset — the confidentiality of stored data. It does nothing about a staff member who hands over credentials to a caller, a stranger walking into an unlocked server room, an adversary pivoting from the mobile app servers onto teller workstations, or the first confused hour after an alert fires. Defense in depth means placing controls in layers so that each layer mitigates the threat it is best suited to, and so that if one control is bypassed or fails, another still limits the damage (2.1.G.2, 2.1.G.3).

Mapped to the layers named in 2.1.G.4: training defends the human layer, the badge reader the physical layer, segmentation the network layer, encryption the data layer, and the incident response plan governs the response across all of them. Those are five different threats, not one threat paid for five times — which is what redundant spending would actually look like.