One of the challenges with ICT security is $$selling$$ the notion of investing in ICT security.

One approach is to use a traditional return on investment approach with an emphasis on

information security issues. This is referred to as a Return on Security Investment $($ROSI$)$

and ROSI calculations can be presented to management to justify security investments.

The ROSI elements discussed during the semester included the following formula

components: Single Loss Expectancy $($SLE$)$; Annual Rate of Occurrence $($ARO$)$; Annual Loss

Expectancy $($ALE$)$ which is calculated: ALE $=$ ARO $*$ SLE; Modified Annual Loss Expectancy

$($MALE$)($this is the ALE after the implementation of the proposed security controls$).$ The

ROSI takes account of the ALE, the MALE and the cost of the proposed controls.