There have been quite a few blogs written about the Return on Investment (ROI) of security. Amrit Williams has several links in his recent discussion of the topic. This reminds me of some work that I did with BearingPoint on the ROI of a Services-Oriented Architecture (SOA), a similarly challenging area in which to quantify value. The framework we used for justification involved underlying business initiatives, traditional ROI metrics and overall strategic drivers. The difficulty in quantifying a business initiative, like extending services through new distribution channels via federation, may be relatively low. Quantifying traditional ROI metrics, on the other hand, may range in difficulty. The value of risk reduction may be more amorphous...