Which of the following should be the PRIMARY basis for determining the value of assets?

From an information security risk management perspective, the primary value of an asset is determined by its criticality to the business. The most accurate measure of this criticality is the cost or impact to the business if the asset were to become unavailable or be compromised. This includes direct financial loss, reputational damage, loss of customer confidence, regulatory penalties, and operational disruption. This business-centric approach ensures that security resources are prioritized to protect the assets most essential to the organization's mission and objectives, a core principle of information security governance.

A. Cost of replacing the assets is a component of recovery but ignores the often much larger business impact of downtime and data loss.

C. Original cost of the assets minus depreciation is an accounting metric that does not reflect an asset's current operational importance or criticality.

D. Total cost of ownership (TCO) is a financial calculation for procurement and budgeting, not a measure of an asset's value in a risk context.

1. ISACA

CISM Review Manual

16th Edition. Chapter 2: Information Risk Management

Section 2.4

"Information Asset Classification." The manual emphasizes that asset valuation should be based on its criticality and the impact of its loss on the business. The process of a Business Impact Analysis (BIA) is cited as the method to determine these impacts

which directly corresponds to the "business cost when assets are not available."

2. Fenz

S.

& Ekelhart

A. (2011). Formalizing Information Security Risk Assessment. Proceedings of the 2011 ACM Symposium on Applied Computing. (DOI: https://doi.org/10.1145/1982185.1982578). This academic paper discusses risk assessment methodologies

noting on page 1746 that "The value of an asset is determined by the damage that is caused if a security goal... is violated." This damage is a direct measure of business cost.

3. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30

Revision 1). Section 2.3

"Risk Assessment

" describes the process of determining the adverse impact of events. Page 13

Table D-3

provides examples of impact levels (Low

Moderate

High) based on the magnitude of harm to "organizational operations

organizational assets

or individuals

" which is a formal way of expressing the business cost.