You are the IT security director for the Weezle Pretzle Company. You have convinced top management the

Question:

You are the IT security director for the Weezle Pretzle Company. You have convinced top management the need to implement ISO 27002. You don’t intend to seek formal certification, so the CFO wants you to provide some measure of the gain that you expect in security effectiveness. So she has asked you to provide her a report on how to evaluate security effectiveness.

Required
a. Write a report to your CFO explaining various options for evaluating information security effectiveness.