A managerial issues-aware cost estimation of enterprise security projects

The evaluation of the cost associated to a security project cannot be done using traditional software cost estimation models. In this paper, we provide a model that numerically estimates the enterprise managerial impact on the cost associated to the achievement of a security project, taking into consideration monitoring, awareness, decision making, organizational, and decision support. Three effort estimation models are proposed according to information system complexity, the security and sensitivity of the services and data managed by the enterprise, and the strength of the existing security policy.