A Cost-Benefit Analysis (CBA) is a fundamental financial process used in risk management to evaluate the viability of a security initiative. It directly compares the monetary cost of implementing and maintaining a control against its projected financial benefit. This benefit is typically measured as the reduction in risk, often quantified by the decrease in the Annualized Loss Expectancy (ALE). The final output of a CBA is a data-driven, financial argument (e.g., Return on Security Investment - ROSI) that provides a quantifiable justification for management to decide whether to approve the expenditure. It translates a technical security requirement into a business-centric financial decision.

1. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30

Revision 1).

Section 3.3.3

Analysis of Alternatives: This section describes the process of evaluating different courses of action for risk response. It states that organizations should "evaluate the relative advantages and disadvantages (e.g.

effectiveness

feasibility

cost-benefit) of the alternative courses of action." This highlights that the CBA is the tool for providing a justifiable comparison.

2. Gordon

L. A.

& Loeb

M. P. (2002). The Economics of Information Security Investment. ACM Transactions on Information and System Security

5(4)

438–457. https://doi.org/10.1145/581271.581274

Page 440: The paper introduces an economic model for information security investment

stating

"The model shows how the optimal amount to invest in information security is an increasing function of the vulnerability of the information to security breaches." The entire premise is to provide a quantifiable

economic justification for security spending

which is the core of a CBA.

3. Van Oorschot

P. C. (2020). Computer Security and the Internet: Tools and Jewels. Springer.

Chapter 10

Section 10.2.2

Risk Analysis: This section discusses quantitative risk analysis

explaining that the goal is to assign monetary values to assets and the impact of threats. It notes that the results

such as the ALE

are used in a cost-benefit analysis to "justify the cost of countermeasures." This directly supports that the result of a CBA is justification.