How Much Security Is Enough?
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
Updates to this material are, in part, either adapted or excerpted from Software Security Engineering: A Guide for Project Managers [Allen 2008].
This article provides guidelines for answering this question, including strategy questions to ask, organizational and market characteristics to take into account, and means for determining adequate security based on risk. It is important to make sure that leaders understand the residual risk that remains after mitigating actions are taken.
Cite This SEI Report
Allen, J. (2013, May 21). How Much Security Is Enough?. Retrieved October 15, 2026, from https://www.sei.cmu.edu/library/how-much-security-is-enough/.
@techreport{allen_2013,
author={Allen, Julia},
title={How Much Security Is Enough?},
month={May},
year={2013},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/how-much-security-is-enough/},
note={Accessed: 2026-Oct-15}
}
Allen, Julia. "How Much Security Is Enough?." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, May 21, 2013. https://www.sei.cmu.edu/library/how-much-security-is-enough/.
J. Allen, "How Much Security Is Enough?," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 21-May-2013 [Online]. Available: https://www.sei.cmu.edu/library/how-much-security-is-enough/. [Accessed: 15-Oct-2026].
Allen, Julia. "How Much Security Is Enough?." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 21 May. 2013. https://www.sei.cmu.edu/library/how-much-security-is-enough/. Accessed 15 Oct. 2026.
Allen, Julia. How Much Security Is Enough?. Software Engineering Institute. 2013. https://www.sei.cmu.edu/library/how-much-security-is-enough/