CISM: Certified Information Security Manager

Controls should be selected based primarily on cost-benefit analysis, balancing the expected risk reduction against the cost of implementing and operating the controls. Regulatory requirements, control frameworks, and best practices are important inputs, but they do not by themselves establish the most economically appropriate control set.