Security for Information Technology: Return on Investment

Return on Investment (ROI) is a common issue among corporate management. The question can seldom be answered to everyone's satisfaction. It is especially harder to answer in the information security context where a lack of data makes it difficult to quantify what exactly security spending earns. The management knows the threat is there but they do not feel the threat. In other words, they cannot justify the spending as they do not have a clear …

…much he should spend on information security. Quantifying ROI is not an easy task; however, it is every information security professional's responsibility to indicate to the management the risks facing his business. For a risk-averse organisation, the issue of ROI is often relatively unimportant. For an organisation willing to take the risk, the ROI will be an important criterion in the decisionmaking. Source See, A.(2004), Measuring ROI on your security spending, The Star Tech Central.