A checklist of considerations for calculating the true cost of an information security breach 1. System downtime. What systems were out of commission and for how long?2. People downtime. Who was unable to work, and how long were they unproductive?3. Hardware and software. How much did it cost to replace servers, hard drives, software programs and so on?4. Consulting fees. If you needed extra firepower while fighting an attack or for a postmortem analysis, how much did you spend on fees and other expenses? 5. Money. How much were the salaries for people affected by the breach? Consider overtime pay or trades that couldn’t be made during downtime.6. Cost of information. What was the value of informationemployee, shareholder, customerthat was stolen or corrupted? How much did retrieving the information cost? 7. Cost of lost business. Did clients take their business elsewhere? Were there opportunity costslost contracts or business dealsdue to systems being compromised? 8. Incidentals. How much did you spend on food, lodging and transportation for the people working to fight the breach? Were there additional facilities costs, such as power usage and electricity?9. Legal costs. What were potential and actual costs of litigating and investigating the incident?10. Cost to your company’s reputation. Did you spend money on a PR campaign to control the damage? Related content news UK government plans 2,500 new tech recruits by 2025 with focus on cybersecurity New apprenticeships and talent programmes will support recruitment for in-demand roles such as cybersecurity technologists and software developers By Michael Hill Sep 29, 2023 4 mins Education Industry Education Industry Education Industry news UK data regulator orders end to spreadsheet FOI requests after serious data breaches The Information Commissioner’s Office says alternative approaches should be used to publish freedom of information data to mitigate risks to personal information By Michael Hill Sep 29, 2023 3 mins Government Cybercrime Data and Information Security feature Cybersecurity startups to watch for in 2023 These startups are jumping in where most established security vendors have yet to go. By CSO Staff Sep 29, 2023 19 mins CSO and CISO Security news analysis Companies are already feeling the pressure from upcoming US SEC cyber rules New Securities and Exchange Commission cyber incident reporting rules don't kick in until December, but experts say they highlight the need for greater collaboration between CISOs and the C-suite By Cynthia Brumfield Sep 28, 2023 6 mins Regulation Data Breach Financial Services Industry Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe