Cyber Security Investment Business Cases and Empirical Evaluation, 2022-2025

This dataset comprises business cases and empirical evaluations of cyber security investment tool ROCSI within UK private sector organisations. The dataset was collected using semi-structured interviews with key stakeholders and supplemented with structured cost and risk assessment data. The data capture both quantitative inputs, including cost breakdowns, asset valuations, and risk metrics as well as qualitative insights from participants, such as perceptions of risk, decision-making rationale, and practical challenges in cyber security investment.

The dataset is designed to support research and analysis in the following areas:
Financial evaluation of cyber security investments, including direct and indirect costs.
Empirical assessment of risk quantification models (e.g., ROCSI).
Organisational decision-making processes, highlighting how technical cyber risks are translated into business impacts.
Qualitative analysis of stakeholder perceptions, including usability, clarity, and perceived value of risk assessment tools.

Files include interview transcripts, coding frameworks, structured Excel datasets, and the interview guide.