Budgeting process for information security expenditures

An empirical study to examine the way corporations make decisions regarding information security expenditures is conducted. The study assessed whether firms approach the budgeting process for information security expenditures in a rational economic manner-based on cost-benefit analysis. Emperical evidence shows that cost-benefit analysis is a sound basis for budgeting information security expenditure. The cost associated with information security activities relate to a host of items, including hardware, software and personnel. A rational economic process used for budgeting capital investments applies cost-benefit analysis using the net present value (NPV). The use of NPV approach to derive an optimal expenditure level can be regarded as an ideal economic approach for budgeting information security. The ability to estimate benefits is a key factor driving the use of NPV analysis in decisions concerning the level of expenditures on information security.