Watch this video on YouTube
How can the return on investment in information security be MOST effectively assessed?