Even so, a majority of the companies surveyed said they rarely or never calculate return on investment when building a case for information security budgets.

"Return on investment appears to have fallen out of favour as a measure of the effectiveness of information security spending," said Mark Doll, Americas director of Ernst & Young's Security Services division.

"It looks like we need to find a credible alternative to conventional ROI approaches to secure funds for the information security function."

The "2003 Ernst & Young Global Information Security Survey" was conducted over a two-month period in early 2003 and includes responses from more than 1,400 organisations in 66 countries.

Not surprisingly, 90% of the organisations surveyed said that IT security is of high importance to them, with 78% identifying risk reduction as the top factor influencing security spending.

[ Read more ]