It is often difficult to determine the real value of information security investments since they do not produce revenue. They instead protect against potential losses. These losses may or may not be realized. As a result, decision-makers are often reluctant to make security investments. There is a way, however, to maximize your security investment and measure its return through risk assessment and return on security investment analysis. This information can be used to prioritize information security investments and help justify additional expenditures.

     There is a fair amount of effort involved and it may require expert help from outside your company, but it will be well worth any investment in time or resources. When your are done with this exercise, you will have an intimate understanding of the value of your information assets as well as priorities for additional security investment and a baseline for measuring results.

     From a business perspective, information security is a function of risk management. Using standard risk assessment techniques and formulas, your organization can focus its limited resources on protecting its most critical information assets. In this process you will determine the risks to specific information assets and develop priorities for reducing them.

     Your company has the option of performing the risk assessment internally or contracting with an outside firm such as InfoDefense to help guide you through the process. Either way, your firm will benefit most if senior level management is closely involved in the process.