How to Approach an MIS Security Case Study Assignment: ALE, ROSI, RBAC and the Board Paper

Quick answer: To approach an MIS security case study assignment, start by declaring your personalised parameters, build every figure in Excel with live formulas, and tie each claim to a numbered evidence line. Then pick controls by a stated decision rule, not by gut feeling. Markers reward justified decisions, not definitions copied from a textbook.

You have a 5,000-word brief on a fictitious Ghanaian health group. It arrives with a log extract, an email header, a wireless configuration dump and a table of insurer data. Your index number decides which row of numbers you use, and a wrong digit means zero for every question that depends on it. That is the situation a recent Masters MIS security case study put students in, and most of the lost marks were avoidable.

Share your brief for guidance

What an MIS security case study assignment actually tests

These briefs look like cybersecurity papers, but they are management papers. You are acting as a consultant to a board that has to decide how much to spend. Logs and access matrices are evidence. The marks sit in the reasoning that connects it to money, law and patient safety.

A typical eight-question structure splits into five skills. The table shows where the marks tend to be earned and where they leak.

Start with the parameter declaration

Do this before anything else. Read your last digit and second-to-last digit, copy the two rows into a declaration table on page one, and then lock those cells. Every later formula should point at them.

The costliest mistake we see is a student who copies the worked example in the brief and carries on with it. The example index is there to show the method, not to be your data. Check the declaration twice against the tables, then once more after you finish Question 3, because a wrong cell silently corrupts the register, the budget decision and the board paper together.

How to build the risk register in Excel

A risk register built on annualised loss expectancy is arithmetic, but arithmetic with traps. The insurer’s table gives each threat a loss basis, two occurrence rates and a control cost. Your job is to turn those into six columns and a recommendation.

The formulas are simple: single loss expectancy (SLE) from the stated basis, ALE as SLE times annual rate of occurrence (ARO), annual risk reduction as the difference between the two ALE values, and return on security investment (ROSI) as reduction minus cost, divided by cost. The method comes from Sonnenreich et al. (2005) and sits inside NIST’s risk-assessment process (Joint Task Force Transformation Initiative, 2012).

Check your own work

1. Recalculate one SLE by hand and compare it with the cell.
2. Confirm ALE after is never higher than ALE before.
3. Check the sign of every ROSI; at least one may be negative.
4. Sum the ALE columns and carry those totals to the board paper unchanged.

If you want to see what a finished register looks like for an illustrative parameter set, we have published a model-answer extract for reference only. It uses one parameter set, so it will not match your numbers, and it is not something to submit as your own.

Choosing controls inside the budget

The brief says the full control list exceeds the security budget. Markers are not hunting for one correct combination; they are checking that you stated a rule and that your choice obeys it. There are three common rules, and each can produce a different answer.

Our advice: use net benefit within budget as the main rule, then test the result against the other two in a short paragraph. If a control with a negative ROSI addresses the very attack described in the case, say so and argue for it with reference to non-financial losses. That argument is usually worth more marks than the arithmetic. NIST’s framework gives respectable language for it (National Institute of Standards and Technology, 2024).

Get your parameters checked

Writing the forensic timeline and the evidence trail

Treat the timeline as a table, not an essay. Four columns do the work: time, event, exhibit and line, and the security failure behind it. Put the email header first, then the authentication log, and sort by time rather than by exhibit.

The question about entry points usually has a trap. Several vectors are visible, but only one chain explains how files were encrypted. Look at which account actually performed the renames, trace when that account was created, and work backwards. Say which vector you chose, then name the evidence you would still request, such as VPN logs, mail-gateway records and an image of an affected workstation (Nelson et al., 2025).

IAM, RBAC and the network question

For the access-control design, build the matrix first and the prose second. Use the codes the brief gives, keep each role to the minimum rights it needs, and name two segregation-of-duties conflicts that the design prevents. A payroll creator who can also approve payment is the classic one.

Then walk through each scenario in the brief as a numbered sequence: who requests, who approves, what is granted, when it expires and what is logged. A promotion, a temporary doctor, a resigning officer with a grievance, an emergency “break-glass” request and night-shift account sharing each need different handling, and the last one needs a practical answer, not a lecture.

The wireless and network design follows the same logic: describe what is wrong in the configuration dump, then fix it with segmented networks, enterprise authentication and a separate guest network. If you need a reference point for the engineering side, our network security assignment help page sets out the topics we cover.

Ghanaian law: what to cite and how

The brief requires at least two Ghanaian sources. Use the Data Protection Act, 2012 (Act 843) for personal data and the Cybersecurity Act, 2020 (Act 1038) for incident reporting. Cite the section you rely on, such as the security-compromise notification duty in Act 843, not just the statute name. Read the sections yourself; do not rely on a summary.

Mark-maximising checklist

• Parameter declaration on page one, matching your own digits.
• Every claim about the incident carries an exhibit and line reference.
• Every calculation is a live Excel formula; the workbook is attached.
• A stated decision rule, and proof the chosen set stays within budget.
• A negative-ROSI control discussed, not hidden.
• RTO and RPO assumptions written out, with the backup weaknesses addressed.
• Board paper within two pages, quoting totals from your own register.
• At least eight credible APA 7 sources, two of them Ghanaian.
• Field audit done in person, with the signed confirmation form.

Common mistakes

Most students leave the board paper to the last evening. Don’t. It is the only place where your numbers, your law and your recommendation meet.

Frequently asked questions

Can I use the same numbers as a classmate if we have the same digits?

Matching digits give matching parameters, but the analysis, wording, workbook layout and reasoning must still be your own. Institutions check for near-identical submissions, and a viva can be called to test whether you understand your own work.

What if my ROSI comes out negative for the ransomware package?

A negative result is allowed and often intended. Report it honestly, then discuss what the number leaves out: patient safety, regulatory penalties, reputational damage and the fact that the attack in the case actually happened. A justified decision to fund it anyway can earn full marks.

Do I have to use Excel formulas, or can I calculate by hand?

If the brief demands live formulas, typed values lose marks even when they are correct. Put your parameters in labelled cells and refer to them in every calculation.

How long should the board paper be?

Within the stated limit, which is two pages in this kind of brief. Open with the decision you want, quote your total ALE before and after, the control cost and the net benefit, then give the 90-day plan.

Which Ghanaian laws should I cite?

At minimum, the Data Protection Act, 2012 (Act 843) and the Cybersecurity Act, 2020 (Act 1038). Cite the specific sections on security measures, breach notification and incident reporting, and say which authorities AHSL-type organisations must inform. Add the regulators’ own reporting pages as supporting sources.

Is it acceptable to get help with an assignment like this?

Seeking academic support is fine, but what you submit must follow your institution’s rules. Our service provides guidance and model answers for reference; you remain responsible for your own submission. Read the brief’s integrity and AI-use declaration before deciding how to use any help.

Where to go next

If you have spent an evening on the parameter tables and the numbers still refuse to reconcile, get a second pair of eyes before the deadline rather than after the penalty. Our subject specialist Liam O’Connor, a Bachelor of IT & Cybersecurity Expert with 16 years’ experience according to his profile, is the sort of reviewer who spots a mislabelled ARO at a glance. For wider context, see our MIS assignment help page and read what other students say on the reviews page.

Submit your assignment details

References

Cybersecurity Act, 2020 (Act 1038) (Ghana). https://ghalii.org/akn/gh/act/2020/1038

Data Protection Act, 2012 (Act 843) (Ghana). https://ghalii.org/akn/gh/act/2012/843

Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1

National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). https://doi.org/10.6028/NIST.CSWP.29

Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST Special Publication 800-61, Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3

Sonnenreich, W., Albanese, J., & Stout, B. (2005). Return on security investment (ROSI): A practical quantitative model. In Proceedings of the 3rd International Workshop on Security in Information Systems (pp. 239–252). SciTePress. https://www.scitepress.org/Papers/2005/25802/