Which of the following surveys should be conducted to determine the effectiveness of risk controls and justify their placement within the security…

A cost-benefit analysis (CBA) is a systematic process used to evaluate the financial feasibility of a project or expenditure. In the context of security, it directly compares the cost of implementing a risk control (countermeasure) against the financial benefit derived from the reduction in risk (e.g., averted losses). This analysis provides a quantitative justification for the control's effectiveness and its value, making it the essential tool for defending its inclusion and priority within the security budget. It answers the fundamental business question: "Is this security measure worth the investment?"

A. Probability analysis: This is a component of risk assessment that estimates the likelihood of an event but does not weigh it against the cost of controls.

C. Cyber risk assessment: This is too specific to the cyber domain and, while it identifies risks, it does not inherently include the financial justification for controls.

D. Vulnerability assessment: This process identifies weaknesses and flaws but does not evaluate the economic efficiency or budgetary justification of the controls designed to mitigate them.

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 11

"Security and the Business

" the text discusses the necessity of using business tools like cost-benefit analysis to justify security expenditures and demonstrate value to the organization.

2. ASIS International. (2021). Protection of Assets (POA)

Security Management. In Chapter 3

"Financial Management

" the text details the use of cost-benefit analysis as a primary method for evaluating and justifying security countermeasures. It explains that this analysis is crucial for making informed decisions and securing budget approval for security initiatives by demonstrating a positive return on investment.

3. Soo Hoo

K. J. (2000). How to Measure the ROI of Security. Stanford University

Center for International Security and Cooperation (CISAC). This paper outlines the methodology for applying economic analysis to security decisions

emphasizing that cost-benefit analysis is the foundational approach to justify security investments by comparing the reduction in loss expectancy to the cost of the control. (Available through Stanford's CISAC archives).