Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".

Am I to compare the cost of a breach with the cost of improving security or I'm required to compare the cost of alternative security enhancements to the current organizational security procedure?

share|improve this question
up vote 0 down vote accepted

Neither, you're being asked to evaluate the costs involved in making changes to procedures. That's all your quote says. Generally those costs will be people costs. In security that may mean how much more effort it is to do things right when building a server, or patching. It could mean how much it will cost to have a working 24x7 incident response.

First you need to do a gap analysis between current procedure and what procedures need to be in order to satisfy policy and security goals, then to perform an analysis on what it will take to change the procedures. They may want that compared to the potential cost of a breach, or the cost of loss of compliance, etc.

share|improve this answer
Thanks a log GdD, if this were an exams I'd have deviated totally. – Napoleon Jan 30 '13 at 13:53
I hope it helps you, sometimes companies don't really know what they want. It may be worth spending time getting to understand what they are really after. – GdD Jan 30 '13 at 14:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.