Measuring ROSI

Arguably, the most effective method of measuring ROSI is by calculating lost productivity, since every organization’s primary objective is to execute business processes effectively. As a result, agency decision-makers need to have answers to the following questions when deciding whether to invest in a security control:

• How much is the lack of security costing the business?
• What impact is the lack of security having on productivity?
• What impact would a catastrophic security breach have?
• What are the most cost-effective solutions?
• What impact will the solutions have on productivity?