I think that to answer this question, you need to have a solid understanding of the value of the assets you are trying to protect. If we think of information security as providing confidentiality, integrity, and availability (CIA), we can also try to determine the cost to the organization if these assurances are undermined.
C: Given the value of some proprietary information, use that to estimate the cost if this data is disclosed.
I: Given the value of some operational data, use that to estimate the potential loss or disruption of operations if this data is maliciously (or accidentally) modified without detection for some time.
A: Given the revenue produced by a service (e.g., e-commerce website), or the productivity enabled by a system (e.g., internal email system), use that to estimate what financial loss would occur if the service or system was to go down for a given period of time. It helps if you have an idea of how long a service disruption is likely to last before being identified and corrected.
As others have mentioned, I would recommend involving the data and service owners in your business to help calculate better value estimates. Not only will your results be more accurate and have more meaning, but you will also increase buy-in from management in the process.