The labor behind one plan
Consider what a risk-informed security plan takes to produce the traditional way. A typical arrangement involves three members of the central security team and two people from the team that owns the resource.
Some resources take a full 40-hour week. Even when the process is streamlined, 16 hours from each person is close to the minimum. That is 80 hours of labor for one plan.
The arithmetic
| Role | People | Hours | Hourly rate | Cost |
|---|---|---|---|---|
| Security staff | 3 | 48 | $86.24 | $4,139.52 |
| Resource owner | 1 | 16 | $190.52 | $3,048.32 |
| Resource team member | 1 | 16 | $86.24 | $1,379.84 |
| Total per resource | 5 | 80 | $8,567.68 |
Now apply that to an organization with 300 resources that need plans. Full coverage costs about $2.57 million a year.
Compared with the value
For an organization of that size in higher education, full coverage, good visibility and an engaged culture are worth about $944,000 a year in reduced risk, under conservative assumptions.
The cost is about two and a half times the benefit. Judged on those numbers, comprehensive coverage cannot be justified.
What happens when the numbers don't work
The outcome is predictable, and it is what most organizations live with:
- Coverage is rationed, and many resources never receive a formal risk analysis.
- Residual risk is accepted by default, without anyone deciding to accept it.
- Security staff are stretched thin and are left to triage.
Partial coverage becomes the norm because it is the only option the traditional model can pay for.
The number to beat
The estimated value becomes a threshold. An approach that delivers the same risk reduction for less than it is worth can be justified, and one that costs more cannot.
A federated approach brings the time for a plan to about one hour, a reduction of nearly 94%. That change in cost is what moves full coverage from unaffordable to sustainable. A Security Plan in an Hour describes how.
Misaligned Incentives explains why the economics so often come out this way.