Answers are grounded in this paper and cite their sources.
Empirical evidence shows that cost-benefit analysis is a sound basis for budgeting information security expenditures.
No takes yet. Share an insight, caveat, or question.
Gordon et al. (2006) studied this question.
Synapse has enriched 10 related papers. Consider them for comparative context: