Evaluating the Business Value of Enterprise Data Protection
A Framework for Cost, Risk, and Operational Resilience
DOI:
https://doi.org/10.66838/sauc.6509Keywords:
Data Protection, Business Value, Return on Security Investment, Operational Resilience, Enterprise Risk Management, Loss Distribution, Cyber Risk, Decision Support.Abstract
Enterprise data protection is usually justified in the language of fear and evaluated in the language of cost. Budget owners see licences, storage and staff time, while the benefits arrive as incidents that did not happen or that were survived with less damage, which are hard to observe and easy to dismiss. This paper proposes the Data Protection Value Framework (DPVF), a structured way to evaluate the business value of data protection along three connected dimensions: the cost of protection, the risk it reduces, and the operational resilience it provides. DPVF links assets, vulnerabilities, threats, controls and countermeasures in a common risk ontology, values assets by business importance, expresses risk as a distribution of annual losses and downtime and not as a single score, and combines the dimensions through explicit weights that reflect the organization’s risk appetite....
Downloads
Global Statistics ℹ️
|
40
Views
|
18
Downloads
|
|
58
Total
|
|
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2025 Authors retain copyright and transfer to the journal the right of first publication and publishing rights
This work is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License.
Those authors who publish in this journal accept the following terms:
-
Authors retain copyright.
-
Authors transfer to the journal the right of first publication. The journal also owns the publishing rights.
-
All published contents are governed by an Attribution-NoDerivatives 4.0 International License.
Access the informative version and legal text of the license. By virtue of this, third parties are allowed to use what is published as long as they mention the authorship of the work and the first publication in this journal. If you transform the material, you may not distribute the modified work. -
Authors may make other independent and additional contractual arrangements for non-exclusive distribution of the version of the article published in this journal (e.g., inclusion in an institutional repository or publication in a book) as long as they clearly indicate that the work was first published in this journal.
- Authors are allowed and recommended to publish their work on the Internet (for example on institutional and personal websites), following the publication of, and referencing the journal, as this could lead to constructive exchanges and a more extensive and quick circulation of published works (see The Effect of Open Access).
