A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding.

The best factor that supports the recommendation of upgrading all perimeter firewalls to mitigate a particular finding is that the expected loss from the risk exceeds mitigation costs. The expected loss from the risk is the product of the probability of occurrence and the impact of the risk, which can be measured by the Annualized Loss Expectancy (ALE). The mitigation costs are the expenses associated with implementing the security controls or countermeasures to reduce the risk. If the expected loss from the risk exceeds the mitigation costs, then it is economically justified to invest in the mitigation strategy, such as upgrading the firewalls. The inherent risk is greater than the residual risk, the ALE approaches zero, and the infrastructure budget can easily cover the upgrade costs are not the best factors that support the recommendation, as they do not indicate the cost-benefit analysis or the return on investment of the mitigation strategy. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 1, Security and Risk Management, page 47. Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 1, Security and Risk Management, page 62.