BC3I: towards requirements specification for preparing an information security budget

The entire business landscape finds itself on the verge of a recessionbecause of ongoing global economic turmoil. Thus, there is a heightenedneed to minimise and mitigate business risk and scrutinise informationspending while ensuring compliance with regulatory mandates. This callsfor decision makers to become vigilant in their spending and movetowards an optimised information security investment. The main aim ofthis paper is to provide decision makers with a set of requirements to beconsidered when implementing a cost-effective and optimal informationsecurity budget; in a manner that preserve organisations’ informationsecurity posture and compliance status. Research reported on in this paperforms part of an ongoing project known as the BC3I (Broad ControlCategory Cost Indicators) framework.