SECOMO: an estimation cost model for risk management projects

In this paper an estimation cost model for risk management projects, called SECOMO is presented. This model helps managers reasoning about the cost and schedule implications of network security decisions that security teams may need to make. It aims to achieve several objectives including: (1) providing accurate cost and scheduling estimates for currently security projects, and (2) providing a normative method for the allocation of resources necessary for the development and maintenance of network security solution.