In \u201c10 Things That WON\u201dT Happen in 2009\u201d, David Kelleher argues that organizations will adopt a \u201cDo more with less\u201d approach to controlling IT security costs.\u00a0While optimizing existing processes and resources can lead to short-term gains, doing so blindly may lead to long-term problems throughout the organization.\u00a0Security spending strategies must support the core-competencies of the business and the needs of the customers that drive the bottom line.The shift toward business-enabling security spending was highlighted by Forrester Research.\u00a0They noted that small to medium-sized business will shift their focus from protecting against computer security threats to protecting their critical data.\u00a0Their analysis also noted a movement towards managed security services.\u00a0More importantly, the article showed that while businesses have yet to accept security as a business-enabler, they do recognize it as a business issue.Before we can highlight the business case for security, we must understand the organization that will pay for those investments.\u00a0In \u201cConsiderations and Foundations for Assuring Software Security: Business Case Models for Rational Action\u201d, Don O\u2019Neill\u00a0notes that \u201ccost is a function of perceived value.\u201d\u00a0\u00a0 An organization, he argues, will gain a competitive advantage from security investments only if its customers value security enough to pay for it.\u00a0Thus, an organization must communicate its security strategy as a value-add for the customer.How can InfoSec professionals influence their company\u2019s brand image? \u00a0They must first understand how security is perceived in relation to the business plan. \u00a0They must then begin to market strategic IT security investments that enhance its competitive edge.\u00a0Mr. O\u2019Neill offers basic questions must be brought before the Board. To what extent does the organization include its global supply chain management operation in its software security assurance operations? To what extent are the management staff and technical staff trained in their software assurance management responsibilities? To what extent is the organization legal staff trained in software security assurance? To what extent are organization executive and senior management trained in their software assurance management responsibilities? To what extent are the members of the board of directors informed of their software security assurance oversight responsibilities? As mentioned in the first part of this series, the value proposition of security must be championed by professionals who can communicate how those investments enable the business.