Which practice best supports achieving cost-effectiveness in security management?

• A. Balancing security outcomes with the budget to maximize value.
• B. Allowing unlimited spending on security.
• C. Focusing only on the cheapest controls.
• D. Ignoring measurement results.

Answer: (C)

Cost-effectiveness in security management means getting the most protection for each dollar spent by aligning the level of security with available resources. The best practice is to balance security outcomes with the budget to maximize value, which means prioritizing controls that deliver the greatest risk reduction for their cost and continuously evaluating their performance. Relying only on the cheapest controls can leave gaps in protection if those measures don’t adequately mitigate high-risk scenarios, while unlimited spending or ignoring measurement results prevents you from optimizing the security program over time. By measuring effectiveness and adjusting the mix of controls to address actual risk, you achieve the most value from the security investment.