Making a security and compliance investment: how to value what you pay for

摘要

Purpose – The purpose of the paper is to emphasize the need for technology and people investments in security and compliance and to show the cost of not making such investments. Design/methodology/approach – The paper describes direct and indirect costs of database intrusions and data thefts, shows ways in which the cost of technology can be justified, and shows examples of how return on investment (ROI) can be calculated. Findings – The paper finds that, in today's data-sensitive climate, automation of stronger data protection practices has become an essential activity. Originality/value – This paper is a practical reminder that security does not come without investment in appropriate automated systems along with related policies and other safeguards.