It is quite difficult to quantify risk, even for the most mature organizations. Getting risk to a reasonable “high-medium-low” is simpler, though less straightforward, and difficult to do consistently across an organization. In specific instances, the costs of individual controls can be known, and the costs of theoretical losses can be estimated, but doing so […]