Which of the following would be MOST relevant to include in a cost-benefit analysis of a two-factor
authentication system?

A.
Annual loss expectancy (ALE) of incidents

B.
Frequency of incidents

C.
Total cost of ownership (TCO)

D.
Approved budget for the project

Explanation:

The total cost of ownership (TCO) would be the most relevant piece of information in that it would
establish a cost baseline and it must be considered for the full life cycle of the control. Annual loss
expectancy (ALE) and the frequency of incidents could help measure the benefit, but would have
more of an indirect relationship as not all incidents may be mitigated by implementing a two-factor
authentication system. The approved budget for the project may have no bearing on what the
project may actually cost.