Which of the following is the BEST reason for senior management to support a business case for developing a monitoring system for a critical…

The most effective business case for any investment, including a security system, is one that is framed in financial terms. Senior management is primarily responsible for the financial health and operational stability of the organization. A cost-benefit analysis that clearly demonstrates that the cost of implementing the monitoring system is less than the potential financial impact of downtime for a critical application provides a direct, quantifiable justification. This approach aligns the security initiative with core business objectives, presenting it not as a cost center but as an investment to prevent a larger, more significant financial loss.

A. An industry peer's breach is a compelling driver but does not provide a direct financial justification tailored to the organization's specific risk exposure.

B. The ability to replicate the system is a secondary benefit concerning return on investment (ROI), not the primary justification for the initial investment.

D. A business case is created to reduce risk to a level within the organization's tolerance, not because the proposed solution is already within it.

1. ISACA

CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Section 1.5.3 Business Case. A business case should include a cost-benefit analysis that "compares the projected costs of a project with the expected benefits." It explicitly states that benefits can include "cost avoidance

such as losses from security incidents." This directly supports that comparing implementation cost to the impact of downtime (a security incident) is a primary component of a strong business case.

2. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.5 Risk Treatment / Risk Response. This section emphasizes that the selection of controls should be based on a cost-benefit analysis. The cost of the safeguard should not exceed the benefit derived

where the benefit is the reduction in expected loss. This principle is the foundation of option C.

3. Gordon

L. A.

& Loeb

M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security (TISSEC)

5(4)

438-457. This foundational academic paper establishes that security investment decisions are economic. It argues that the amount to invest in information security should be based on the potential losses and the effectiveness of the security measures

which is a form of cost-benefit analysis. (https://doi.org/10.1145/581271.581274)