Information Security Research Library

Companies use different methods for cost-justifying security assessments, just as they use various methods to cost-justify spending on security itself. North American Scientific funds its security assessments, like all its security spending, based on its estimate of the value of its information assets. Holbert says the company views its security spending almost as a form of insurance against the loss of its valuable information assets. "How do you value the loss of your e-mail system? How do you value the loss of certain electronic assets like price lists or customer lists?" he asks. Compared to traditional insurance, he says, spending on security and security assessment is a bargain.