This Technical Report provides guidelines on how an organization can make decisions to protect
information and understand the economic consequences of these decisions in the context of competing
requirements for resources.
This Technical Report is applicable to all types and sizes of organizations and provides information
to enable economic decisions in information security management by top management who have
responsibility for information security decisions.