MT300 Unit 9 Security Risk Assessment Example

Course	MT300 Management of Information Systems
Unit	Unit 9
Paper type	Security risk assessment
Length	About 870 words, 6 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	BS in Business Administration
Updated	October 2026

Free sample paper for MT300 Unit 9

Rated in Saturdays and Dollars: An MT300 Unit 9 Security Risk Assessment for a Rental Company's Cloud Proposal

[Student Name]

Purdue University Global

MT300: Management of Information Systems

Unit 9 Security Risk Assessment

[Instructor Name]

[Date]

Larkfield Event Rentals, its risks and figures are composite; the framework and sources cited are real.

What this part is doingGiving the total price of safety in the lead answers the owner's first question before any detail.

Summary

The cloud proposal can be operated safely if it adds four contract clauses, two new routines and device management at $480 a year. None of the six risks is a reason not to proceed; each changes how the proposal is carried out.

What Is Being Protected

The assets are few: the order and customer files; site access notes such as gate codes; deposits and balances in transit; the ten tablets; and the platform itself.

Six Risks

1. Fraudulent payment instructions. Threat: a criminal who has seen a client's email sends a message, apparently from Larkfield, asking a wedding client to pay the balance into a new account. Touches: balances in transit, customer trust. Likelihood: likely. The FBI's internet crime report lists business email compromise among the costliest reported frauds (Federal Bureau of Investigation, 2024). Impact: an $11,000 wedding balance paid to the wrong account, a client who blames Larkfield. Response: every invoice states that bank details never change by email; balances are paid through the platform's card link only. Change to proposal: disable bank transfer details on invoices.

2. A tablet left on a truck seat. Threat: a tablet is stolen from an unlocked truck at a venue. Touches: the day's site notes and photos. Likelihood: likely, with ten tablets and seasonal crews. Impact: gate codes for a day's private homes in a stranger's hands. Response: device management at $480 a year to lock and wipe tablets remotely; a passcode required; site notes cleared when the route closes. Change to proposal: add device management to the budget.

3. Seasonal accounts still active in November. Threat: a former seasonal worker's login still works after they leave. Touches: orders and site notes. Likelihood: possible. Impact: a former employee viewing gate codes months later. Response: a routine on the last payroll day of each worker: the office manager disables the account. Change to proposal: add offboarding to the office checklist.

4. Vendor outage on a June Saturday. Threat: the cloud platform is unavailable for several hours. Touches: the whole day's operations. Likelihood: rare, but impact is high. Impact: forty events without pick tickets. Response: pick tickets printed the evening before and kept in each truck; a contract clause requiring Saturday support response within four hours. Change to proposal: add the printing routine and the support clause.

5. Vendor failure or acquisition. Threat: the specialist vendor, about seventy employees, closes or is bought. Touches: all data. Likelihood: possible over five years. Impact: loss of order history and customer master. Response: the contract obliges the vendor to hand over every record each month in a format Larkfield can open elsewhere. Change to proposal: export clause.

6. Weak passwords on office accounts. Threat: a guessed or reused password lets someone into the office account. Touches: everything. Likelihood: possible. Impact: the full customer file exposed. Response: multifactor sign-in required for office roles; a contract clause confirming the vendor supports it. Change to proposal: multifactor clause.

Each risk here ends as a line in the contract or a step in a routine, which is what treating protection as a constraint on the proposal means.

What this part is doingFolding every response back into the proposal shows the assessment shaped the decision rather than following it.

What Changes in the Proposal

Before this assessment, the proposal treated security as the vendor's job. After it, the proposal includes a device management subscription, a printing routine for the evening before each event day, an offboarding step on the last payroll day, multifactor sign-in for office roles and four contract clauses: monthly export, Saturday support response, multifactor support and the price cap already negotiated. Invoices change too: they now carry a line telling clients that Larkfield never changes bank details by email. These are small changes, but each one closes a risk that would otherwise sit with the owner.

Why the Ratings Are Coarse

Likelihood is rated rare, possible or likely, and impact is described in business terms. Precise scores would claim knowledge Larkfield does not have, and the owner can weigh "forty events without pick tickets" more easily than "impact 4."

The Framework Check

Version 2.0 of the NIST Cybersecurity Framework sorts its outcomes into six functions, the newest of which, Govern, sits over the other five (National Institute of Standards and Technology, 2024). Placing the risks under them confirms coverage.

Govern: office manager as owner of security routines; quarterly review.

Identify: the asset list above.

Protect: multifactor sign-in, device passcodes, least-privilege roles from the Unit 7 brief.

Detect: platform login alerts for office accounts.

Respond: remote wipe of a lost tablet; client notice of attempted payment fraud.

Recover: printed pick tickets; monthly data export.

Larkfield has not adopted the framework. This check uses it only to confirm that no function is empty.

Costs

Added cost: $480 a year for device management. Contract clauses and routines cost staff time of about one hour a month. Laudon and Laudon (2022) note that security controls cost money and time, and these are small beside a single lost wedding balance.

What this part is doingComparing the added cost with one realistic loss puts the security budget in terms the owner already uses.

References

Federal Bureau of Investigation. (2024). Internet crime report 2023. Internet Crime Complaint Center. https://www.ic3.gov/AnnualReport/Reports/2023_IC3Report.pdf

Laudon, K. C., & Laudon, J. P. (2022). Management information systems: Managing the digital firm (17th ed.). Pearson.

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29

Reading the MT 300 Unit 9 instructions

In Unit 9 students assess the security risks of the system proposed earlier in the course. The assessment should identify the assets at stake and the threats realistic for this organization. Each risk should be described in plain words, rated for likelihood and impact and paired with a response. Instructors expect responses to change the proposal, through contract terms, routines or added costs, rather than sit in a separate list. Many prompts ask for impact in business terms. A recognized framework, often the NIST Cybersecurity Framework, may be used to check coverage. The assessment should be written for a manager deciding whether to proceed, so a summary of the total cost of safety is useful up front.

Inside the MT300 Unit 9 example

The sample's summary gives the result: six risks, four clauses, two routines and $480 a year. The assets are listed briefly. Six risks follow, each with a threat, what it touches, a likelihood, a business impact, a response and a change to the proposal, from disabling bank details on invoices to multifactor sign-in. The FBI report supports the rating of payment fraud. The highlighted line explains that each risk ends as a contract line or a routine. A section lists every change to the proposal. Coarse ratings are justified. A framework check sorts each response into one of the framework's six functions, with none left empty. Costs are compared with a single lost wedding balance, citing Laudon and Laudon.

Where the points sit in the MT300 Unit 9 rubric

Security risk assessments are typically evaluated on the realism of threats, the quality of ratings, the strength of responses and their integration into the proposal. Graders reward threats drawn from what actually happens to small firms rather than generic catalogs. Impact should be described in terms a manager understands. Responses should be specific, costed and folded back into the proposal. Coarse ratings with clear reasoning are preferred to precise scores without evidence. A framework check should confirm coverage without implying compliance. A summary for the decision-maker is expected. Sources such as government crime reports and recognized frameworks belong in APA 7. Assessments that list risks without changing the proposal miss the purpose of the unit.

MT300 Unit 9 help: mistakes that cost points

Security assessments often list technical threats such as malware and hacking without connecting them to this organization's assets. Another common weakness is rating risks on precise numeric scales the company has no data to support. Responses may be generic, such as "use strong security," with no cost or owner. Some students describe a framework at length instead of using it to check coverage. Many assessments never change the proposal they assess. Before drafting, list the assets the new system would hold and think about the last few incidents small firms like yours have suffered. Send that list and the prompt, and a risk assessment can be drafted around your organization.

Get an MT300 Unit 9 example written to your instructions

Whatever your case company plans to buy, each risk in the Unit 9 sample ends as a change to that plan. Share the prompt, the rubric and, if it exists, your earlier proposal. The first custom assessment is free and returns in 24-48h, using NIST or another framework only in the way your instructor asks. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More MT300 papers and BS in Business Administration samples

MT300 Unit 9 questions, answered

Should the assessment use NIST CSF 2.0?

Only if the prompt asks, or as a coverage check. The framework's six functions help confirm that governance, detection and recovery were not forgotten, but a small-business assessment built entirely around its categories tends to read as a template. Name it accurately, use it narrowly, and avoid implying the organization has adopted it.

How technical should a manager-level risk assessment be?

Technical enough to name each threat and control correctly, and no further. Multifactor sign-in, remote wipe and data export can each be explained in a sentence of plain language. Space belongs to what each risk would cost the business and what the response costs, because those are the figures a manager decides on.

Is a numeric risk matrix required?

Some prompts supply one, and then it should be used. Where none is required, coarse levels with business descriptions are often more honest for a small firm, since precise probabilities would be invented. Whichever scale appears, define its levels in a line so a reader can see why each rating was given.

Where can I find a free MT300 Unit 9 sample paper?

The complete MT300 Unit 9 security risk assessment is on this page, rating six risks for a rental company's cloud proposal.

What does the MT300 Unit 9 sample add to the proposal?

Four contract clauses, two new routines and device management at $480 a year, plus a line on invoices about bank details.