# Exercise: Opportunity Cost Analysis

Evaluate the true opportunity cost of security investments using this framework:

1. For your proposed security investment: 

- List all direct costs (purchase, implementation, maintenance)
- Identify resources required (staff time, management attention, technical infrastructure)
- Document business impacts during implementation

2. For each alternative use of these resources: 

- Quantify expected financial return
- Identify strategic objectives supported
- Document risks created or perpetuated

3. For the "do nothing" security alternative: 

- Calculate expected loss exposure (ALE)
- Identify compliance gaps created
- Document strategic initiatives potentially blocked

4. Comparative analysis: 

- Create a side-by-side comparison of financial impacts
- Evaluate alignment with strategic priorities
- Assess risk/return profiles of each alternative

This comprehensive analysis helps demonstrate that security investments represent optimal resource use compared to alternatives, including the "do nothing" option that appears to preserve resources but creates significant risk exposure.

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)