Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Cost-Benefit Analysis for Risk Treatment
Is it worth it?
Every control costs something: money, staff time, convenience. Cost-benefit analysis asks whether the risk a control removes is worth that cost, and which of several options gives the best value. It’s how the security manager turns risk analysis into a sensible recommendation for the risk owner.
Comparing options
Account takeover currently has an ALE of 500,000. Four options:
| Option | Annual cost | ALE after | Risk reduced | Net benefit |
|---|---|---|---|---|
| Do nothing | 0 | 500,000 | 0 | 0 |
| A: Training only | 40,000 | 350,000 | 150,000 | 110,000 |
| B: MFA + training | 120,000 | 100,000 | 400,000 | 280,000 |
| C: Full zero-trust rebuild | 520,000 | 40,000 | 460,000 | −60,000 |
Option B gives the best net benefit. Option C reduces the most risk but costs more than it saves. If B also brings the residual risk within appetite, it’s the recommendation.
The costs people forget
- Implementation: project staff, consultants, integration, data migration.
- Running: licences, people to operate the control, monitoring, support.
- Productivity: extra steps for users, slower processes, help-desk calls.
- End of life: upgrades, replacement, decommissioning.
Beyond the numbers
Some factors don’t fit neatly into the calculation:
- Is the control required by law, regulation or contract?
- Could a failure harm people or affect safety?
- How would customers and regulators view the decision?
- Does the option fit the organisation’s culture and architecture?
Example. A hospital’s analysis shows encrypting old medical devices costs more than the expected loss. But patient-safety and privacy rules require it, so the board approves it anyway and records why.
Cost-benefit analysis informs the risk owner’s decision; it doesn’t replace it.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main purpose of cost-benefit analysis | Choose the most cost-effective treatment |
| The benefit of a control | The reduction in expected loss (ALE) |
| A control costs more than the loss it prevents | Usually not justified, unless required |
| Which costs to include | The full life cycle, including running and productivity costs |
| Who decides after the analysis? | The risk owner |
In short
- Cost-benefit analysis compares the cost of a treatment with the risk it removes, to choose the option with the best value.
- Benefit is usually the reduction in expected loss (ALE before minus ALE after).
- Costs include the full life cycle: purchase, implementation, running, people, training, maintenance and impact on productivity.
- A control costing more than the loss it prevents is rarely justified, unless a law or contract requires it.
- Non-financial factors (regulatory requirements, reputation, safety, customer demands) also weigh in the decision.
- Compare several options, including doing nothing, and choose the one that brings residual risk within appetite most cost-effectively.
Exam traps
- Choosing the option with the most risk reduction ignores cost; choose the best value within appetite.
- Ignoring running and productivity costs makes options look cheaper than they are.
- Legal or regulatory requirements can override a negative cost-benefit result.
- Cost-benefit analysis informs the risk owner's decision; it doesn't replace it.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Comparing options