A Budget Model for Information Security
This paper presents a model to assist in deriving a cost-effective and optimal information security budget. The derived budget focuses on an adequate mix of administrative, operational and environmental controls enabling organizations to comply with relevant regulatory mandates. The results seek to provide guidance on how decision makers can achieve optimal protection of their information assets in the face of shrinking information security budgets. A case study illustrates the implementation of the proposed model.