If you are an information security or business continuity professional, then you\u2019re probably aware of the most difficult part of your job: to convince your management that investment in information security\/business continuity makes sense.<\/p>\n
Traditionally, \u201cmaking sense\u201d for management means that the revenues that will result from the investment will be larger than the total cost of investment. (Of course, there are some other aspects the management will also consider \u2013 read Management\u2019s view of information security<\/a>).<\/p>\n So what\u2019s the problem? The problem is, even if you can calculate the total cost, there are no revenues to be made; OK, instead of revenues you might have cost savings, but the general opinion is that these are impossible to calculate.<\/p>\n However, I think there is a way to estimate the financial benefits (i.e. cost savings) of information security. Let\u2019s take a deeper look of what it really means.<\/p>\n First of all, you need to estimate the potential damage an incident could cause \u2013 it is also called the Single Lost Expectancy or SLE. But to calculate SLE you need to take into account several factors:<\/p>\n The next step is to estimate the likelihood \u2013 normally, you would have to consider threats and vulnerabilities, as well as existing security measures. The best way is to assess how often you think such an incident would occur \u2013 e.g. once every three months, once every three years or once every 30 years.<\/p>\nIs it really impossible?<\/h2>\n
\n