The most effective way to minimize the impact of a control failure is to employ Defense in Depth,
which involves:
Layered Security Controls: Implementing multiple, overlapping security measures to protect assets.
Redundancy: If one control fails (e.g., a firewall), others (like IDS, endpoint protection, and network
monitoring) continue to provide protection.
Minimizing Single Points of Failure: By diversifying security measures, no single failure will
compromise the entire system.
Adaptive Security Posture: Layered defenses allow quick adjustments and contain threats.
Other options analysis:
A . Business continuity plan (BCP): Focuses on maintaining operations after an incident, not directly
on minimizing control failures.
B . Business impact analysis (BIA): Identifies potential impacts but does not reduce failure impact
directly.
D . Information security policy: Guides security practices but does not provide practical mitigation
during a failure.
CCOA Official Review Manual, 1st Edition Reference:
Chapter 7: Defense in Depth Strategies: Emphasizes the importance of layering controls to reduce
failure impacts.
Chapter 9: Incident Response and Mitigation: Explains how defense in depth supports resilience.
