Mercer Paints is a small but highly regarded paint manufacturing company located in Alabama. The company has a network in place, linking many of its business operations. While the firm feels that its security is adequate, the recent addition of a Web site has been an open invitation to hackers. Management requested a risk assessment. The risk assessment identified several potential exposures; these exposures, associated probabilities, and average losses are summarized in the following table.

Mercer Paints Risk Assessment

Exposure	Probability of Occurrence (%)	Average Loss ($)
Malware attack	60%	$75,000
Data loss	12%	$70,000
Embezzlement	3%	$30,000
User errors	95%	$25,000
Threats from hackers	95%	$90,000
Improper use by employees	5%	$5,000
Power failure	15%	$300,000

In addition to the potential exposures listed, you should identify at least three other potential threats to Mercer Paints, assign probabilities, and estimate a loss range. Using a spreadsheet product and the risk assessment data provided on the Laudon Web site, calculate the expected annual loss for each exposure. Which control points have the greatest vulnerability? What recommendations would you make to Mercer Paints? Prepare a written report that summarizes your findings and recommendations.