ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A total cost of ownership (TCO) analysis sums all expenses tied to a proposed control throughout its entire life cycle, including procurement, licensing, implementation, operations, maintenance, and eventual disposal. This holistic view lets planners estimate the full budget and schedule requirements for mitigation.

Single loss expectancy is used in quantitative risk assessment to calculate potential loss from one event, not to estimate project funding needs. Return on security investment (ROSI) compares expected benefits to costs but does not itself total those costs. A GAAP depreciation schedule only spreads capital expenditures over accounting periods and ignores many operational expenses. Therefore, TCO is the most appropriate technique for identifying the complete financial resources required to implement and sustain the new DLP solution.