What is the potential cost of a security incident to your business?
Estimating the financial impact of a security incident to your organisation is a difficult task. That’s why the National Protective Security Authority (NPSA) has developed a bespoke tool to help security managers in the UK obtain a realistic estimate of the cost of losing a critical asset – The Asset Cost Estimation Tool (ACET).
This tool is free to use and should only take about 15 minutes to complete if you have already identified your critical assets.
About the ACET
Requiring only three key pieces of information – annual turnover, estimated number of full-time employees, and business sector – the ACET can help you to identify your critical assets as part of a security risk assessment process. It will then deliver an estimate of financial loss should any of these assets be affected by a security incident. These cost estimates can be used to evaluate options and develop business cases for the introduction of new security plans and measures, in a targeted and proportionate way. The ACET is completely confidential. It does not store any inputted data, nor is it logged or cached. If you choose to save your data this will be to your local storage, so you remain in control of your data.
How the ACET works
NPSA, the UK’s National Technical Authority for personnel and physical security, has developed the ACET drawing on credible open sources relating to past security incidents. The tool will ask you to identify the assets you wish to cost estimate and place them into the following categories: people, processes, technology, information, and facilities. Each one of these categories is then further sub-divided to give more granularity to the final cost estimate.
To obtain the most accurate estimate you will be asked to identify your lowest and highest expected cost of losing that asset, and a confidence level for your figures. Where you are less than 100 per cent confident in your figures, the tool can lean on open-source data for similar incidents in your sector to provide more data on which to base an estimate. If you have no knowledge of the cost of losing your asset, but would still like to obtain an estimate, you can select an ‘industry standard’ option. The ACET will provide a cost estimate based on relevant open-source data within the tool.
You can pause your estimate at any time and save it locally to gather more information, and return to it at a later date. The tool has built in step-by-step guides to support you as you work through the estimation process and also links to NPSA’s website for advice on security risk assessment and identifying critical assets
The ACET instantly produces user-friendly, downloadable, graphs and charts, enabling users to visualise estimated losses, reasonable worst-case scenarios, and exposure per asset. Additionally, the ACET provides users with a comparison with other organisations in their selected sector where sufficient open-source data is available. Where there is insufficient data for your sector to make a reliable estimate, the tool will select the nearest comparison sector and will inform you where that data has been derived from.
How to access the ACET
To access the tool, visit the NPSA website at www.npsa.gov.uk/acet. NPSA continues to research and develop this tool and your feedback would be very welcome.
