Tutor, many would say that a company should plan for events through some process that measures or estimate risks of damage to the company that would result from security breaches.
How can risks of damage be measured or estimated? What process would you use to help management understand the damage that specific risks could cause?