| Course | WMBA 6030 Managing Business Information Systems |
|---|---|
| Week | Week 5 |
| Paper type | Board brief |
| Length | About 820 words, 5 pages |
| Format | APA 7 student paper |
| School | Walden University |
| Program | Master of Business Administration (MBA) |
| Updated | October 2026 |
Free sample paper for WMBA 6030 Week 5
Four Exposures, One Ask: A Security Brief to the Board of an Event Rental Company on What Would Actually Hurt, What Each Could Cost and the $68,000 a Year That Would Cut the Worst of It
Student Name
Walden University
WMBA 6030: Managing Business Information Systems
Instructor Name
Month Day, Year
Four Exposures, One Ask: A Security Brief to the Board of an Event Rental Company on What Would Actually Hurt, What Each Could Cost and the $68,000 a Year That Would Cut the Worst of It
What the Board Must Decide
Harwood's board should approve about $68,000 a year in security spending and one payment policy, effective before the May start of the event season. The spending addresses the four exposures that would most hurt Harwood Tent and Event, the composite event rental company used in this course. This brief does not describe what the technology team does each day; it describes what the board needs to decide.
The Four Exposures
Table 1
Exposures, Likely Cost if They Occur and Rough Annual Likelihood
| Exposure | What happens | Cost if it occurs | Rough likelihood in a year | |
|---|---|---|---|
| Payment fraud by email | A spoofed message changes a vendor's or venue's bank details, or diverts a client's deposit | $40,000 to $150,000 per incident | High, about 1 in 4 | |
| Ransomware in peak season | Rental, scheduling and email systems locked for a week in June | $350,000 to $700,000 in lost and refunded events plus recovery | Moderate, about 1 in 20 | |
| Account takeover of a former employee's access | A departed staff member's login used to view client data or alter orders | $20,000 to $80,000 | Moderate, about 1 in 10 | |
| Card data exposure through the website | Payment details stolen from the online checkout | $50,000 to $200,000 in fines, card reissue costs and notification | Low, about 1 in 30 | |
Costs and likelihoods are estimates for a composite company; they are meant to rank the exposures, not to predict them precisely.
Payment fraud ranks first because it is both likely and costly. Harwood pays dozens of venues, tent suppliers and subcontractors each month and receives large deposits from corporate clients, often by bank transfer. In federal complaint data for 2024, fraudulent payment emails ranked second among all crime types by dollars lost: 21,442 complaints reporting roughly $2.77 billion, close to $129,000 apiece (Federal Bureau of Investigation, 2025).
Ransomware ranks second because its timing would be ruinous. A week without the rental system in June would mean crews arriving at weddings without knowing what to load. The move to a cloud rental platform, proposed in Week 2, reduces this risk but does not remove it, because email, file storage and staff laptops would still be targets.
What the Money Buys
The ask is matched to the exposures. Multifactor sign-in on every account, including email and the rental platform, costs about $9,000 a year and is the single most effective defense against both payment fraud and account takeover. Managed monitoring of laptops and email by an outside service costs about $36,000 a year and gives the company someone watching at night and on weekends, when events happen. Backups kept separately from the network, with a restore test every quarter, cost about $14,000 a year and turn a ransomware attack from a lost week into a lost day. Security training focused on payment requests, with simulated phishing, costs about $9,000 a year.
The policy costs nothing: no change to any payee's bank details is accepted by email alone. Every change must be confirmed by calling the payee at the phone number the company already holds, and any transfer over $10,000 needs two approvers.
Is $68,000 the Right Amount?
In the model Gordon and Loeb (2002) built, the security spending that makes sense for a given breach rarely exceeds about 37 percent of the loss the firm expects from it. Using the midpoints and likelihoods in the table, the expected annual loss across the four exposures is about $59,000, which would suggest spending of roughly $22,000. The full proposal spends more, for two reasons. The likelihoods may be low for a company moving large transfers every week in season, and a peak-season ransomware event is a single loss of a size that could threaten the year, which an expected-value rule does not capture. If the board prefers to stay within the model's bound, a smaller package of multifactor sign-in, separate backups and the payment policy costs about $23,000 and addresses the two largest exposures in part.
What the Board Should Ask Each Quarter
The board should receive four numbers each quarter: the share of accounts with multifactor sign-in, the result of the latest restore test, the click rate on simulated phishing and any payment change requests that failed the callback check. These are written to fit the categories of the NIST Cybersecurity Framework 2.0, which organizes security work into governing, identifying, protecting, detecting, responding and recovering (National Institute of Standards and Technology, 2024), so the board can see coverage at a glance.
What This Does Not Cover
The brief excludes physical theft from warehouses and risks at subcontractors, which belong in separate reviews, and it does not replace a review of the company's cyber insurance, which should be completed before renewal.
References
Federal Bureau of Investigation. (2025). Internet crime report 2024. Internet Crime Complaint Center. https://www.ic3.gov/AnnualReport/Reports
Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438-457. https://doi.org/10.1145/581271.581274
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
WMBA 6030 Week 5 instructions, in plain terms
Security assignments in a business information systems course often ask students to brief senior leaders or a board on cybersecurity risk. Prompts usually require the three or four exposures that would most hurt the organization, an estimate of what each would cost, and a specific request for spending or policy. Instructors expect the brief to be written for decision makers, not technicians: plain language, numbers, a clear ask. They discourage descriptions of the security team's daily work. Briefs usually run two to three pages. Many prompts welcome a framework, such as NIST's, for organizing what the board should monitor. Testing the request against an economic rule, and offering a smaller option, shows respect for the board's job of weighing cost against risk.
How this WMBA 6030 Week 5 example is built
The brief opens with the decision requested and its cost. A table names four exposures with what happens, the cost if it occurs and a rough annual likelihood. Paragraphs explain why payment fraud ranks first, citing FBI figures, and why ransomware's timing matters most. A section matches each spending item to the exposures it addresses and adds a callback policy for bank detail changes. A section tests the total against Gordon and Loeb's model, computes the expected annual loss and explains why the full proposal exceeds the model's suggestion, then offers a smaller package. A section gives the board four quarterly numbers, organized by the NIST framework. A closing note says what the brief excludes. The request, the exposure table and the economic test carry side comments.
Reading the WMBA 6030 Week 5 rubric
Graders reward a brief that leads with a decision and costs. Ranking exposures by cost and likelihood, even roughly, shows the student can prioritize. Matching each spending item to the exposures it reduces demonstrates that the request is reasoned rather than a wish list. A policy that costs nothing but addresses a major exposure often earns notice. Testing the request against an economic model, and being candid when the request exceeds it, shows maturity. Offering a smaller alternative respects the board's authority. Giving the board a few numbers to monitor turns a one-time decision into oversight. Instructors also check that external figures are accurate and cited. Plain wording, brevity and correct APA references take the remaining points.
WMBA 6030 Week 5 help: mistakes that cost marks
List what would actually hurt your organization, in business terms: lost revenue, fraud, fines, downtime in the busy season. Estimate a cost range and a rough likelihood for each, and rank them. Then match each proposed control to the exposures it reduces. Students often lose marks by writing about firewalls and patching instead of business consequences, or by asking for a budget without saying what it buys. Another common gap is giving the board nothing to monitor afterward. If your request exceeds what an economic rule would suggest, explain why or offer a smaller option. Check any statistics against their source. Keep the brief short. If you would like a custom sample board brief for your own organization's risks, send us a description of the business.
Get a WMBA 6030 Week 5 example written to your instructions
Bring the Week 5 brief instructions and rubric to the desk and a board-ready draft returns in 24-48h, the first one free. Say who the stated audience is, since a brief for an audit committee and one for a full board differ in detail, and name the industry so regulatory references land correctly. Exposures specific to your own systems will not be in it.
More WMBA 6030 papers and MBA samples
- WMBA 6030 Week 1: Systems and Strategy Post
- WMBA 6030 Week 2: Enterprise Platform Evaluation
- WMBA 6030 Week 3: Data Investment Memo
- WMBA 6030 Week 4: Online Channel Unit Economics
- WMBA 6030 Week 6: RFID Hype Evaluation
- WMBA 6030 Week 7: Rental Platform Proposal
- WMBA 6030 Week 8: Final Platform Proposal
- WMBA 6040 Week 5: Lean Waste Analysis
- WMBA 6020 Week 5: Idea Pipeline Design
- WMBA 6050 Week 5: Flexible Budget Variance Report
- WMBA 6010 Week 5: Conflict Approach Post
WMBA 6030 Week 5 questions, answered
Where can I find a free WMBA 6030 Week 5 sample paper?
The full security board brief, including the exposure table and spending request, is published here.
What are the four exposures?
Payment fraud by email, ransomware in peak season, a former employee's account taken over and card data stolen online.
How much does the brief request?
About $68,000 a year, with a smaller $23,000 option.
What policy does it add?
No payee bank change is accepted by email alone; changes need a callback, and large transfers need two approvers.
What does Gordon and Loeb's model suggest?
Spending generally no more than about 37 percent of the expected loss, about $22,000 here.