Cost of controls

The cost of a control is not the licence fee. It is the licence, the implementation, the ongoing operation, and the friction it adds to everybody else's work.

That last part is real and almost never counted, which is how organisations end up with controls that cost more in collective time than the risk they address. Asking what this will cost the people who have to live with it is a legitimate question rather than resistance.

Checked against the primary source.

More on Metrics, decisions & economics