One of the biggest information security decisionmaking challenges is finding economic value data that makes an ROI calculation for a security investment useful. Unfortunately, no magic bullet exists to resolve the problem, but a couple of stand-in approaches to the exploration of value might help.

Any manager knows that demonstrating the ROI of information security products is problematic at best. One of the biggest challenges is coming up with baseline data against which to measure a performance improvement and therefore value.