9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

Q: An enterprise risk analyst evaluates a proposed Web Application Firewall (WAF) to protect an e-commerce platform. The underlying digital asset value is estimated at $5,000,000. Prior to control deployment, a successful web application exploit results in an Exposure Factor of 40% (0.40). Actuarial incident records establish an Annualized Rate of Occurrence (ARO) of 0.50 (one incident every two years). The proposed WAF reduces the post-implementation Exposure Factor to 10% (0.10) while maintaining the same event frequency. The annualized total cost of ownership for the WAF safeguard is $300,000 per year. What is the Net Economic Benefit of implementing this control?

$450,000. Calculating Net Economic Benefit involves three sequential steps: First, determine Inherent Loss: SLE_before = Asset Value ($5,000,000) x Exposure Factor (0.40) = $2,000,000. ALE_before = SLE_before ($2,000,000) x ARO (0.50) = $1,000,000. Second, determine Residual Loss: SLE_after = Asset Value ($5,000,000) x Residual Exposure Factor (0.10) = $500,000. ALE_after = SLE_after ($500,000) x ARO (0.50) = $250,000. Third, determine Net Benefit: Risk Reduction (ALE_saved) = ALE_before ($1,000,000) - ALE_after ($250,000) = $750,000. Net Benefit = ALE_saved ($750,000) - Annual Cost of Safeguard ($300,000) = $450,000. The positive result of $450,000 demonstrates substantial economic value.

Q: A Chief Information Security Officer (CISO) is formulating an executive investment proposal for an automated Security Information and Event Management (SIEM) platform. The quantitative risk analysis reveals that the annualized loss expectancy prior to control deployment is $800,000 per year. Following full implementation and tuning, the projected residual annualized loss expectancy drops to $200,000 per year. The annualized cost of the safeguard (including multi-year licensing, cloud ingest fees, and dedicated SOC analyst staffing) totals $250,000 per year. What is the Return on Security Investment (ROSI) for this control?

140%. Return on Security Investment (ROSI) measures the percentage return generated by a security control: First, calculate Risk Reduction (ALE_saved): ALE_before ($800,000) - ALE_after ($200,000) = $600,000. Next, apply the ROSI formula: ROSI = [(ALE_saved - Annual Cost of Safeguard) / Annual Cost of Safeguard] x 100%. Substituting values: ROSI = [($600,000 - $250,000) / $250,000] x 100% = [$350,000 / $250,000] x 100% = 1.40 x 100% = 140%. A ROSI of 140% indicates that the investment generates significant net financial savings beyond its operating costs.

Q: When constructing a comprehensive Cost-Benefit Analysis for an enterprise Privileged Access Management (PAM) implementation, an IT risk practitioner must account for Total Cost of Ownership (TCO). Which of the following elements represents an operational expenditure component of TCO that organizations most frequently underestimate during initial project justification?

Ongoing operational expenses, including continuous policy maintenance, custom integration scripting, administrative analyst overhead, and end-user productivity training.. Total Cost of Ownership (TCO) comprises both initial capital expenditures (CapEx) and long-term operational expenditures (OpEx). Organizations frequently underestimate ongoing operational costs such as dedicated personnel time for policy administration, continuous API integration maintenance, specialized engineering overhead, helpdesk support for user onboarding, and training. Initial software license costs, appliance hardware invoices, and sales taxes are upfront, highly visible one-time expenses that are rarely overlooked in initial procurement quotes.

Q: An IT risk assessment reveals that an internal file server experiences an Annualized Loss Expectancy of $200,000 due to accidental data corruption and user error. A proposed third-party automated continuous backup and synchronization tool costs $150,000 annually and is projected to reduce the Annualized Loss Expectancy to $80,000 per year. There are no statutory, regulatory, or contractual mandates governing this system. Based on standard financial Cost-Benefit Analysis principles, what advice should the risk practitioner provide to the business asset owner?

Advise against implementing the control in its proposed form because the annual cost exceeds the risk reduction by $30,000, resulting in a negative net economic benefit.. A Cost-Benefit Analysis evaluates whether the risk reduction outweighs the cost of the safeguard: Risk Reduction (ALE_saved) = ALE_before ($200,000) - ALE_after ($80,000) = $120,000. Annual Cost of Safeguard (ACS) = $150,000. Net Benefit = ALE_saved ($120,000) - ACS ($150,000) = -$30,000 per year (negative net benefit). Because the control costs $30,000 more annually than the loss it prevents and there are no regulatory mandates requiring it, the risk practitioner should advise against implementation in its current form and explore more cost-effective alternative solutions. Recommending a control solely on percentage risk reduction ignores financial viability.

Key Takeaways

Cost-Benefit Analysis (CBA) evaluates whether the financial reduction in risk exposure outweighs the Total Cost of Ownership (TCO) of implementing and operating a security safeguard.
The Net Economic Benefit of a control is calculated as: Net Benefit = ALE(before control) - ALE(after control) - Annual Cost of Safeguard (ACS).
Return on Security Investment (ROSI) quantifies the percentage yield of a security control: ROSI = [(ALE_saved - Annual Cost of Safeguard) / Annual Cost of Safeguard] * 100%.
Total Cost of Ownership (TCO) extends beyond initial capital acquisition (CapEx) to encompass operational expenses (OpEx) including integration, licensing, administration, training, maintenance, and productivity friction.
A control is deemed economically non-viable if the Annual Cost of Safeguard exceeds the Annualized Loss Expectancy or if Net Benefit is negative, unless non-negotiable legal or regulatory mandates require implementation.

Last updated: August 2026

9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

Enterprise security controls cannot be justified simply by asserting that they make the organization "more secure." Executive leadership and Boards of Directors operate in an environment of constrained capital and competing business priorities. To secure funding and demonstrate sound governance, IT risk practitioners must provide quantitative, defensible financial justifications for proposed risk treatments.

Cost-Benefit Analysis (CBA) and Return on Security Investment (ROSI) are the primary quantitative methodologies used in enterprise risk management to evaluate whether the financial risk reduction delivered by a control outweighs the total cost to acquire, implement, and maintain that control over its operational lifecycle.

+-----------------------------------------------------------------------------+
|                  QUANTITATIVE CONTROL VALUATION FRAMEWORK                   |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   | 1. QUANTIFY INHERENT RISK (ALE Before Control)                      |   |
|   |    - Asset Value (AV) x Exposure Factor (EF) = Single Loss (SLE)    |   |
|   |    - SLE x Annualized Rate of Occurrence (ARO) = ALE_before         |   |
|   +----------------------------------+----------------------------------+   |
|                                      |                                       |
|                                      v                                       |
|   +---------------------------------------------------------------------+   |
|   | 2. QUANTIFY RESIDUAL RISK (ALE After Control)                       |   |
|   |    - Calculate reduced SLE and/or reduced ARO under control         |   |
|   |    - SLE_residual x ARO_residual = ALE_after                        |   |
|   +----------------------------------+----------------------------------+   |
|                                      |                                       |
|                                      v                                       |
|   +---------------------------------------------------------------------+   |
|   | 3. CALCULATE TOTAL COST OF OWNERSHIP (Annual Cost of Safeguard)     |   |
|   |    - Annualized CapEx (Hardware, Software, Integration)             |   |
|   |    - Annualized OpEx (Maintenance, Staffing, Training, Overhead)    |   |
|   +----------------------------------+----------------------------------+   |
|                                      |                                       |
|                                      v                                       |
|   +---------------------------------------------------------------------+   |
|   | 4. EXECUTE CBA & ROSI EVALUATION                                    |   |
|   |    - Net Benefit = (ALE_before - ALE_after) - ACS                   |   |
|   |    - ROSI (%) = [ (ALE_saved - ACS) / ACS ] x 100%                  |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

1. Foundational Quantitative Risk Metrics

Before executing a Cost-Benefit Analysis, risk practitioners must master the core quantitative risk equations defined by ISACA and the Society of Information Risk Analysts (SIRA).

+-----------------------------------------------------------------------------+
|                    CORE QUANTITATIVE RISK EQUATIONS                         |
|                                                                             |
|   1. Single Loss Expectancy (SLE):                                          |
|      SLE = Asset Value (AV) x Exposure Factor (EF)                          |
|                                                                             |
|   2. Annualized Loss Expectancy (ALE):                                      |
|      ALE = Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO|
|      ALE = AV x EF x ARO                                                    |
|                                                                             |
|   3. Risk Reduction / Control Benefit (ALE_saved):                          |
|      ALE_saved = ALE_before - ALE_after                                     |
|                                                                             |
|   4. Net Economic Benefit of Control (CBA):                                 |
|      Net Benefit = (ALE_before - ALE_after) - Annual Cost of Safeguard (ACS)|
|      Net Benefit = ALE_saved - ACS                                          |
|                                                                             |
|   5. Return on Security Investment (ROSI):                                  |
|      ROSI = [ (ALE_saved - ACS) / ACS ] x 100%                              |
+-----------------------------------------------------------------------------+

Definitions of Core Variables:

Asset Value (AV): The comprehensive financial value of the asset, including replacement cost, intellectual property value, data reconstruction expense, and associated revenue generation ($).
Exposure Factor (EF): The percentage of the asset value that is lost or compromised as a result of a single successful threat event (expressed as a decimal from 0.0 to 1.0 or percentage 0% to 100%).
Single Loss Expectancy (SLE): The monetary loss expected each time a specific risk event occurs ($).
Annualized Rate of Occurrence (ARO): The estimated frequency or probability with which a specific threat event is expected to occur within a single calendar year (e.g., once every 5 years = 0.20; 3 times per year = 3.0).
Annualized Loss Expectancy (ALE): The total projected monetary loss an organization expects to suffer from a specific risk over a one-year period ($/year).

2. Cost-Benefit Analysis (CBA) Decision Mechanics

The fundamental principle of Cost-Benefit Analysis in risk management is that the cost of a control should not exceed the benefit it delivers.

+-----------------------------------------------------------------------------+
|                     CBA ECONOMIC DECISION CRITERIA                          |
|                                                                             |
|   Condition                      Economic Assessment   Governance Action    |
|   ----------------------------   -------------------   -----------------    |
|   Net Benefit > $0 (ROSI > 0%)   Positive Value Add    PROCEED with Control |
|   Net Benefit = $0 (ROSI = 0%)   Breakeven             EVALUATE Intangibles |
|   Net Benefit < $0 (ROSI < 0%)   Value Destruction     REJECT or REDESIGN   |
|                                                        (Unless Reg. Mandate)|
+-----------------------------------------------------------------------------+

The Net Benefit Equation

$\text{Net Benefit} = (\text{ALE}_{\text{before}} - \text{ALE}_{\text{after}}) - \text{ACS}$ Where:

$\text{ALE}_{\text{before}}$ = Baseline annualized loss expectancy prior to control implementation.
$\text{ALE}_{\text{after}}$ = Residual annualized loss expectancy remaining after control implementation.
$\text{ACS}$ = Annual Cost of Safeguard (or Annualized Cost of Control, ACC).

[!IMPORTANT] The Golden Rule of CBA: If $\text{Net Benefit} > 0$, the safeguard saves more money in risk reduction than it costs to operate, making it economically sound. If $\text{Net Benefit} < 0$, the safeguard costs more than the risk it mitigates. In the absence of statutory, legal, or regulatory compliance mandates, an organization should not implement a control with a negative net benefit.

3. Return on Security Investment (ROSI)

While CBA produces an absolute dollar figure (Net Benefit in $), Return on Security Investment (ROSI) expresses the financial efficiency of a security investment as a percentage yield.

$\text{ROSI} = \left( \frac{\text{ALE}_{\text{saved}} - \text{ACS}}{\text{ACS}} \right) \times 100\%$ $\text{ROSI} = \left( \frac{(\text{ALE}_{\text{before}} - \text{ALE}_{\text{after}}) - \text{ACS}}{\text{ACS}} \right) \times 100\%$

Interpreting ROSI Values:

ROSI > 100%: Highly attractive security investment. The control generates risk savings more than double its annual operating cost.
ROSI between 0% and 100%: Economically viable investment. Risk savings exceed annual cost.
ROSI = 0%: Breakeven. Risk savings exactly equal control cost.
ROSI < 0% (Negative): Economically inefficient. The enterprise is spending more on protection than it expects to save in loss prevention.

4. Total Cost of Ownership (TCO) Architectural Model

A critical failure in risk budgeting is evaluating controls based solely on initial purchase price (CapEx) while ignoring ongoing operational expenses (OpEx). The Total Cost of Ownership (TCO) encompasses all direct and indirect expenditures incurred across the entire lifespan of the control.

+-----------------------------------------------------------------------------+
|                   TOTAL COST OF OWNERSHIP (TCO) BREAKDOWN                   |
|                                                                             |
|   [1. ACQUISITION COSTS (CapEx)]                                            |
|   - Software licensing / Hardware appliance procurement                    |
|   - Server infrastructure, storage, and networking capacity                 |
|                                                                             |
|   [2. IMPLEMENTATION & INTEGRATION COSTS]                                   |
|   - External consulting & systems integration fees                          |
|   - Architecture customization, API scripting, database tuning              |
|                                                                             |
|   [3. RECURRING OPERATIONAL COSTS (OpEx)]                                   |
|   - Annual vendor maintenance, support contracts, subscription fees         |
|   - Patching, updates, signature feeds, threat intelligence subscriptions   |
|                                                                             |
|   [4. PERSONNEL & ADMINISTRATIVE OVERHEAD]                                  |
|   - Dedicated FTE security analysts and system administrator hours          |
|   - Policy documentation, compliance auditing, reporting overhead           |
|                                                                             |
|   [5. TRAINING & CULTURAL ENABLEMENT]                                       |
|   - Technical training for IT operations & SOC engineers                   |
|   - End-user awareness campaigns and change enablement                      |
|                                                                             |
|   [6. OPERATIONAL FRICTION & DOWNTIME]                                      |
|   - User productivity loss due to friction (e.g., login delays)             |
|   - Helpdesk ticket surge for password/MFA resets and false positives       |
|                                                                             |
|   [7. DECOMMISSIONING & END-OF-LIFE]                                        |
|   - Secure data sanitization, hardware recycling, migration costs           |
+-----------------------------------------------------------------------------+

Calculating Annual Cost of Safeguard (ACS) from TCO:

To incorporate multi-year capital investments into an annual CBA calculation, one-time capital expenditures (CapEx) are annualized across the expected operational lifespan (typically 3 to 5 years) and added to annual recurring operating expenses (OpEx):

$\text{ACS} = \left( \frac{\text{Initial CapEx}}{\text{Useful Lifespan in Years}} \right) + \text{Annual OpEx}$

5. Step-by-Step Worked Quantitative Scenarios

Scenario 1: E-Commerce Payment Database Protection

An enterprise manages a customer transaction database. The risk team is evaluating the deployment of a Database Activity Monitoring (DAM) and Hardware Security Module (HSM) encryption solution.

Given Risk Parameters:

Asset Value (AV): $10,000,000 (Customer data, regulatory liability, and brand value)
Inherent Exposure Factor (EF_before): 40% (A major breach compromises $4,000,000 of asset value)
Annualized Rate of Occurrence (ARO_before): 0.50 (Historical threat models indicate an attack every 2 years)
Proposed Control Costs:
- Initial Hardware & Software Procurement (CapEx): $300,000 (depreciated over 3 years = $100,000/year)
- Annual Licensing & Vendor Support: $120,000/year
- Dedicated Security Administrator Staffing: $80,000/year
Projected Residual Exposure with Control:
- Residual Exposure Factor (EF_after): 5% (Encryption and DAM limit data exfiltration)
- Residual Rate of Occurrence (ARO_after): 0.20 (Controls deter opportunistic attackers)

+-----------------------------------------------------------------------------+
|                 STEP-BY-STEP CALCULATION: PAYMENT DATABASE                  |
|                                                                             |
|   Step 1: Calculate Inherent Risk Metrics (Before Control)                  |
|   - SLE_before = AV x EF_before = $10,000,000 x 0.40 = $4,000,000          |
|   - ALE_before = SLE_before x ARO_before = $4,000,000 x 0.50 = $2,000,000   |
|                                                                             |
|   Step 2: Calculate Residual Risk Metrics (After Control)                   |
|   - SLE_after = AV x EF_after = $10,000,000 x 0.05 = $500,000              |
|   - ALE_after = SLE_after x ARO_after = $500,000 x 0.20 = $100,000          |
|                                                                             |
|   Step 3: Calculate Annual Cost of Safeguard (ACS)                          |
|   - Annualized CapEx = $300,000 / 3 years = $100,000/year                   |
|   - Annual OpEx = $120,000 + $80,000 = $200,000/year                        |
|   - Total ACS = $100,000 + $200,000 = $300,000/year                         |
|                                                                             |
|   Step 4: Calculate Risk Reduction (ALE_saved)                              |
|   - ALE_saved = ALE_before - ALE_after = $2,000,000 - $100,000 = $1,900,000 |
|                                                                             |
|   Step 5: Calculate Net Economic Benefit (CBA)                              |
|   - Net Benefit = ALE_saved - ACS = $1,900,000 - $300,000 = $1,600,000      |
|                                                                             |
|   Step 6: Calculate Return on Security Investment (ROSI)                    |
|   - ROSI = [ ($1,900,000 - $300,000) / $300,000 ] x 100%                   |
|   - ROSI = [ $1,600,000 / $300,000 ] x 100% = 533.33%                      |
|                                                                             |
|   Conclusion: Net Benefit is +$1.6M/year; ROSI is 533%. PROCEED immediately.|
+-----------------------------------------------------------------------------+

Scenario 2: Endpoint Detection and Response (EDR) Deployment

An enterprise evaluates deploying EDR across 2,000 workstations to counter ransomware outbreaks.

Given Risk Parameters:

Asset Value (AV): $2,500,000 (Workstation fleet & operational productivity)
Inherent SLE: $1,000,000 (Exposure Factor = 40%)
Inherent ARO: 0.80 (Event expected 4 times every 5 years)
ALE_before: $1,000,000 x 0.80 = $800,000/year
Residual SLE (with EDR): $250,000 (Rapid containment reduces impact)
Residual ARO (with EDR): 0.20 (Reduced outbreak probability)
ALE_after: $250,000 x 0.20 = $50,000/year
Total Annual Cost of Safeguard (ACS): $150,000/year (SaaS licenses + SOC staffing)

Calculation:

$\text{ALE}_{\text{saved}} = $800,000 - $50,000 = $750,000$
$\text{Net Benefit} = $750,000 - $150,000 = \mathbf{$600,000/\text{year}}$
$\text{ROSI} = [($750,000 - $150,000) / $150,000] \times 100% = [$600,000 / $150,000] \times 100% = \mathbf{400%}$

6. Non-Financial & Regulatory Override Factors in CBA

While mathematical CBA is fundamental, certain enterprise realities take precedence over purely quantitative calculations.

+-----------------------------------------------------------------------------+
|                     NON-FINANCIAL CONTROL JUSTIFIERS                        |
|                                                                             |
|   1. REGULATORY & STATUTORY MANDATES                                        |
|      - GDPR, HIPAA, SOX, PCI-DSS, NYDFS requirements                        |
|      - Failure to comply risks criminal liability, license revocation,      |
|        and automatic debarment from market participation.                   |
|                                                                             |
|   2. REPUTATIONAL CAPITAL & CUSTOMER TRUST                                  |
|      - Loss of customer confidence in banking/healthcare causes terminal    |
|        attrition that standard BIA financial models underestimate.          |
|                                                                             |
|   3. CONTRACTUAL OBLIGATIONS (B2B SLAs)                                     |
|      - Major enterprise client contracts mandating SOC 2 Type II or ISO     |
|        27001 certification as a condition of doing business.                |
|                                                                             |
|   4. SAFETY & CRITICAL INFRASTRUCTURE PROTECTION                            |
|      - Life safety risks in healthcare, aviation, and energy grids where    |
|        loss of life cannot be assigned a standard financial cap.            |
+-----------------------------------------------------------------------------+

[!WARNING] The Compliance Exception to Negative Net Benefit: If a control has a negative net economic benefit (costs more than expected risk reduction) but is explicitly required by a binding legal or regulatory statute, the control MUST be implemented. In this scenario, the risk being treated is not merely the technical vulnerability, but the existential regulatory risk of operating license revocation.

Test Your Knowledge

An enterprise risk analyst evaluates a proposed Web Application Firewall (WAF) to protect an e-commerce platform. The underlying digital asset value is estimated at $5,000,000. Prior to control deployment, a successful web application exploit results in an Exposure Factor of 40% (0.40). Actuarial incident records establish an Annualized Rate of Occurrence (ARO) of 0.50 (one incident every two years). The proposed WAF reduces the post-implementation Exposure Factor to 10% (0.10) while maintaining the same event frequency. The annualized total cost of ownership for the WAF safeguard is $300,000 per year. What is the Net Economic Benefit of implementing this control?

$1,000,000

$450,000

$750,000

-$50,000

Test Your Knowledge

A Chief Information Security Officer (CISO) is formulating an executive investment proposal for an automated Security Information and Event Management (SIEM) platform. The quantitative risk analysis reveals that the annualized loss expectancy prior to control deployment is $800,000 per year. Following full implementation and tuning, the projected residual annualized loss expectancy drops to $200,000 per year. The annualized cost of the safeguard (including multi-year licensing, cloud ingest fees, and dedicated SOC analyst staffing) totals $250,000 per year. What is the Return on Security Investment (ROSI) for this control?

50%

100%

140%

240%

Test Your Knowledge

When constructing a comprehensive Cost-Benefit Analysis for an enterprise Privileged Access Management (PAM) implementation, an IT risk practitioner must account for Total Cost of Ownership (TCO). Which of the following elements represents an operational expenditure component of TCO that organizations most frequently underestimate during initial project justification?

The initial software license purchase price quoted on the vendor's primary bill of materials.

The upfront physical appliance acquisition invoice and freight delivery charges.

The local government sales tax assessed on the initial hardware purchase.

Ongoing operational expenses, including continuous policy maintenance, custom integration scripting, administrative analyst overhead, and end-user productivity training.

Test Your Knowledge

An IT risk assessment reveals that an internal file server experiences an Annualized Loss Expectancy of $200,000 due to accidental data corruption and user error. A proposed third-party automated continuous backup and synchronization tool costs $150,000 annually and is projected to reduce the Annualized Loss Expectancy to $80,000 per year. There are no statutory, regulatory, or contractual mandates governing this system. Based on standard financial Cost-Benefit Analysis principles, what advice should the risk practitioner provide to the business asset owner?

Advise against implementing the control in its proposed form because the annual cost exceeds the risk reduction by $30,000, resulting in a negative net economic benefit.

Strongly recommend deploying the software because any safeguard that achieves a 60% reduction in risk exposure is inherently justified.

Recommend immediate emergency capital allocation to purchase the tool to ensure all data corruption events are fully eliminated.

Advise the business owner to accept the inherent risk without further analysis because IT backup tools never generate positive financial returns.

Up Next

9.3 Developing & Implementing Risk Action Plans

Continue learning

Certified in Risk and Information Systems Control

CRISC Certified in Risk and Information Systems Control

9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

Key Takeaways

9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

1. Foundational Quantitative Risk Metrics

Definitions of Core Variables:

2. Cost-Benefit Analysis (CBA) Decision Mechanics

The Net Benefit Equation

3. Return on Security Investment (ROSI)

Interpreting ROSI Values:

4. Total Cost of Ownership (TCO) Architectural Model

Calculating Annual Cost of Safeguard (ACS) from TCO:

5. Step-by-Step Worked Quantitative Scenarios

Scenario 1: E-Commerce Payment Database Protection

Given Risk Parameters:

Scenario 2: Endpoint Detection and Response (EDR) Deployment

Given Risk Parameters:

Calculation:

6. Non-Financial & Regulatory Override Factors in CBA

Certified in Risk and Information Systems Control

1Chapter 1: Exam Overview & Risk Foundations

2Chapter 2: Enterprise Governance & Organizational Strategy

3Chapter 3: Risk Governance Frameworks & ERM

4Chapter 4: Risk Culture, Ethics & Policy Architecture

5Chapter 5: Asset Management & Business Resilience Governance

6Chapter 6: IT Risk Identification & Threat Modeling

7Chapter 7: Risk Analysis Methodologies & Evaluation

8Chapter 8: Risk Register, Aggregation & BIA Integration

9Chapter 9: Risk Treatment Strategies & Cost-Benefit Analysis

10Chapter 10: Control Design, Selection & Assessment

11Chapter 11: Third-Party & Supply Chain Risk Management

12Chapter 12: Risk Monitoring, KRIs & Executive Reporting

13Chapter 13: Enterprise IT Architecture & Operations

14Chapter 14: Information Security Principles, IAM & SSDLC

15Chapter 15: Incident Response, Resilience & Emerging Tech Risk

CRISC Certified in Risk and Information Systems Control

9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

Key Takeaways

9.2 Cost-Benefit Analysis & Return on Security Investment (ROSI)

1. Foundational Quantitative Risk Metrics

Definitions of Core Variables:

2. Cost-Benefit Analysis (CBA) Decision Mechanics

The Net Benefit Equation

3. Return on Security Investment (ROSI)

Interpreting ROSI Values:

4. Total Cost of Ownership (TCO) Architectural Model

Calculating Annual Cost of Safeguard (ACS) from TCO:

5. Step-by-Step Worked Quantitative Scenarios

Scenario 1: E-Commerce Payment Database Protection

Given Risk Parameters:

Scenario 2: Endpoint Detection and Response (EDR) Deployment

Given Risk Parameters:

Calculation:

6. Non-Financial & Regulatory Override Factors in CBA