In evaluating security investments, which approach is appropriate?

• A. Short-term budget impacts should drive all security investments.
• B. Focus on regulatory compliance costs only, ignoring risk reductions.
• C. Compare total cost of ownership with expected risk reduction and intangible benefits like safety and reputation.
• D. Rely solely on vendor promises without evaluating actual risk.

Answer: (C)

Evaluating security investments should center on value by weighing what you pay against what you gain in risk reduction and organizational benefits. The best approach looks at total cost of ownership—the upfront purchase price plus all ongoing costs for operation, maintenance, and eventual disposal—and compares that to the expected reduction in risk, including both the probability of incidents and the potential impact if they occur. It also accounts for intangible benefits like improved safety, customer trust, and reputation, which can be material to the organization’s success. This broad view ensures you consider long‑term costs and real security value rather than just immediate budget figures, regulatory fees, or vendor promises.