Relative costs involved in making changes to the current organisational security

Question

I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".

Am I to compare the cost of a breach with the cost of improving security or I'm required to compare the cost of alternative security enhancements to the current organizational security procedure?

Answer 1

Neither, you're being asked to evaluate the costs involved in making changes to procedures. That's all your quote says. Generally those costs will be people costs. In security that may mean how much more effort it is to do things right when building a server, or patching. It could mean how much it will cost to have a working 24x7 incident response.

First you need to do a gap analysis between current procedure and what procedures need to be in order to satisfy policy and security goals, then to perform an analysis on what it will take to change the procedures. They may want that compared to the potential cost of a breach, or the cost of loss of compliance, etc.