• Bodin, Lawrence, Lawrence A. Gordon, and Martin P. Loeb, “Evaluating Information Security Investments using the Analytic Hierarchy Process,” Communications of the ACM, February 2005, pp. 79-83.

The Analytic Hierarchy Process (AHP) is a tool for analyzing multi-criteria decision problems involving quantitative and qualitative criteria. This paper shows how a Chief Information Security Officer can apply the AHP to determine the best way to spend a limited information security budget and to make a case to the organization's Chief Financial Officer for an increase in funds to further enhance the organization's information security.