Scenario 2: Return on Security Investment (ROSI)

Security investment is a little more complex. There are no tangible gains in investment directed at information security. The return is measured on risk avoidance. The formula for calculating ROSI is given below.

ArmCPU has been attacked by the BAD-VIRUS before. The damage as a result of the BAD-VIRUS in 2017 was $52,000 for all occurrences and all users. The implementation of an anti-virus solution was $25,000 for all of its users. The anti-virus solution worked 75% of the time on BAD-VIRUS.

Identify the following from the data given:

What is the Risk Exposure?

What is the percentage of risk mitigated?

How much did the solution Cost?

Compute ROSI?