Incorporating cost-benefit analyses into software assurance planning

The objective is to use cost-benefit analyses to identify, for a given project, optimal sets of software assurance activities. Towards this end we have incorporated cost-benefit calculations into a risk management framework. The net result is the capability to rapidly explore the costs and benefits of sets of assurance decisions. We describe the cost-benefit aspects of our framework, and demonstrate them on a small illustrative example. We then address the issues raised by seeking to apply this approach to software assurance planning for large-scale software development efforts