Information Security Management Metrics

36 ◾ Information Security Metrics

e result might be considered to be the “price” of the additional outcome pur-

chased by switching from current practice to the new strategy.

3.2.4.1 Cost-Benefit Analysis

Closely related formal techniques include cost-benefit analysis and benefit-

effectiveness analysis. Cost benefit is typically used to determine the financial fea-

sibility of a particular course of action and may be used to compare options as

well. At the most basic level it consists of totaling all relevant costs compared to all

benefits reduced to financial terms. In some cases both intangible costs and benefits

may be difficult to quantify, as in the case of the possible benefit of improved public

perception of an organization. e intang