Which of the following is BEST to include in a business case when the return on investment (ROI) for an information security initiative is difficult to calculat...