# Security Investment Financial Analysis Toolkit

- **PURPOSE:** Enables security and finance leaders to quantify security investment value using business financial metrics, making security projects comparable to other business investments.
- **WHEN TO USE:**When developing formal business cases, preparing board presentations, or comparing multiple security investment options.

## PART 1: COST ANALYSIS

Total Cost of Ownership (3-Year)

Initial purchase: $\_\_\_\_\_\_\_\_\_\_\_\_

Implementation costs: $\_\_\_\_\_\_\_\_\_\_\_\_

Training: $\_\_\_\_\_\_\_\_\_\_\_\_

Integration: $\_\_\_\_\_\_\_\_\_\_\_\_

Annual maintenance: $\_\_\_\_\_\_\_\_\_\_\_\_ × 3 = $\_\_\_\_\_\_\_\_\_\_\_\_

Internal labor: $\_\_\_\_\_\_\_\_\_\_\_\_

Upgrades/refreshes: $\_\_\_\_\_\_\_\_\_\_\_\_

TOTAL TCO: $\_\_\_\_\_\_\_\_\_\_\_\_

## PART 2: RISK REDUCTION VALUATION

For Each Key Risk Being Addressed:

Asset value at risk: $\_\_\_\_\_\_\_\_\_\_\_\_

Single loss expectancy (SLE): $\_\_\_\_\_\_\_\_\_\_\_\_

Annual rate of occurrence before (ARO): \_\_\_\_\_\_\_\_\_\_\_\_%

Annual rate of occurrence after (ARO): \_\_\_\_\_\_\_\_\_\_\_\_%

Annual loss expectancy before (ALE): $\_\_\_\_\_\_\_\_\_\_\_\_ (SLE × ARO before)

Annual loss expectancy after (ALE): $\_\_\_\_\_\_\_\_\_\_\_\_ (SLE × ARO after)

Annual risk reduction value: $\_\_\_\_\_\_\_\_\_\_\_\_ (ALE before - ALE after)

3-year risk reduction total: $\_\_\_\_\_\_\_\_\_\_\_\_

## PART 3: BUSINESS ENABLEMENT VALUE

Operational Efficiency:

FTE time savings: \_\_\_\_\_\_\_\_\_\_\_\_ hours × $\_\_\_\_\_\_\_\_\_\_\_\_ hourly rate = $\_\_\_\_\_\_\_\_\_\_\_\_

Process improvement savings: $\_\_\_\_\_\_\_\_\_\_\_\_

Total operational value: $\_\_\_\_\_\_\_\_\_\_\_\_ annually × 3 = $\_\_\_\_\_\_\_\_\_\_\_\_

Revenue Protection/Enablement:

Revenue streams protected: $\_\_\_\_\_\_\_\_\_\_\_\_

New market opportunities enabled: $\_\_\_\_\_\_\_\_\_\_\_\_

Total revenue impact: $\_\_\_\_\_\_\_\_\_\_\_\_ annually × 3 = $\_\_\_\_\_\_\_\_\_\_\_\_

## PART 4: FINANCIAL METRICS

3-year ROI: \_\_\_\_\_\_\_\_\_\_\_\_% ((Total benefits - TCO) ÷ TCO × 100)

Payback period: \_\_\_\_\_\_\_\_\_\_\_\_ months (TCO ÷ Annual benefits × 12)

NPV (10% discount rate): $\_\_\_\_\_\_\_\_\_\_\_\_

## PART 5: UNCERTAINTY ANALYSIS

Three-Point Estimation:

Optimistic outcome: $\_\_\_\_\_\_\_\_\_\_\_\_

Most likely outcome: $\_\_\_\_\_\_\_\_\_\_\_\_

Pessimistic outcome: $\_\_\_\_\_\_\_\_\_\_\_\_

Expected value: $\_\_\_\_\_\_\_\_\_\_\_\_

## IMPLEMENTATION TIPS:

- Collaborate with Finance to ensure your methodology aligns with company financial standards
- Document all assumptions to maintain credibility and transparency
- Compare against alternative investments the business is considering to provide proper context

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)