Putting a Dollar Value to Cyber Risks
Is it possible to calculate the return of investment on cybersecurity controls?
Traditionally, organisations have struggled to calculate the financial losses from cyberattacks/ fraud and prioritise security investments based on Return of investment (ROI). Frameworks such as APRA CPS 234 demand regulated entities to maintain information security capability commensurate with information security vulnerabilities and threats. However, the APRA CPS 234 framework doesn’t provide enough information to articulate cyber risks in financial metrics with which business executives and board are familiar with. FAIR is one framework that helps quantify the risks and measure the expected financial loss due to a cyber attack.