Assume you are the CIO (Chief Information Officer) of a major, publicly traded, corporation and that your firm currently budgets and spends $80 million per year on cybersecurity related activities to protect its various information systems. Fortunately, your firm has not had a major cybersecurity breach up to this point in time. In contrast, several of your firms competitors have had a major cybersecurity breach within the last three years. Accordingly, you have decided to ask your firms CFO (Chief Financial Officer) for a significant upgrade to your firms cybersecurity related activities (in terms of hardware, software, additional staff, training programs, etc.). Your request is for a $20 million increase in spending on cybersecurity related activities. Because your firms CFO recognizes the importance of cybersecurity, in the past she has accepted a request for additional cybersecurity related spending from you (i.e., the CIO) without asking you to provide any rigorous justification for the request. However, given the size of the increase you are now requesting (i.e., a 25% increase), this time the CFO asks you to provide a detailed explanation to justify the proposed $20 million increase in cybersecurity spending.

Required: Provide a hypothetical explanation for your CFO to justify the $20 million increase in cybersecurity spending. Your explanation should include actual numbers (including the dollar amount of potential loss from a major cybersecurity breach, the probability of a potential major cybersecurity breach, and the degree to which the additional spending would reduce the probability of such a breach, etc.) to justify the request. In essence, you are being asked to provide what many executives refer to as a business case for the proposed $20 million increase in cybersecurity spending.