Achieving an ideal security level is a balancing act. Organisations cannot afford perfect
security. The useful question is where the cost of countermeasures meets the probable cost
of breaches — and whether that balance point sits inside the organisation’s
tolerable risk and operating constraints.
Teaching note: Paraphrased for learning from IACS risk-assessment practice
and related ISA/IEC 62443 concepts. Not a verbatim extract of ISA publications or the
standard — always refer to published text for normative wording.
Figure – Conceptual balance between investment in countermeasures and probable breach
cost. Each organisation sets its own balance point against tolerable risk.
Reading the curves
Cost of security countermeasures typically rises as the security level
increases — often steeply toward the high end (more specialised controls, more process
overhead, more maintenance).
Probable cost of security breaches typically falls as security improves —
fewer successful attacks and/or less severe outcomes.
The balance point is where further spend buys little residual-risk reduction
relative to its cost — or where breach risk is already acceptable under policy.
Part 3-2 does not prescribe a single economic model. It expects residual risk to be
compared with organisational tolerance, and treatment decisions (mitigate, transfer, accept)
to be deliberate. Cost/complexity versus effectiveness is one of the practical filters in
Develop a Plan.
Practical tips
Include operating cost, outage windows and skills — not only capital purchase price.
Prefer controls that cut likelihood or impact for several high residual threats.
Use Part 3-3 SL capability ratings as a guide to relative strength of technical options,
then still judge site-specific effectiveness.
Document why a cheaper control was chosen — or why a costly one was justified by
consequence severity.
Key takeaways
Perfect security is not a realistic target; balance investment against breach cost and
tolerable risk.
Each organisation’s balance point differs with risk appetite, regulation and process hazard.
Economic judgement belongs in treatment planning after risk scoring, not instead of it.
