## 5 Comprehensive Cost Computation Model
### Computation of Data Breach Cost  
To calculate the total data breach cost (CPR) for each compromised record, we combine all the partial costs for the type of data breach. Then, we can use the values of some factors that impact the total breach cost per record by using the data from the IBM/Ponemon calculator that is shown in Tables 4-6. These values are used as a variation measure when the user chooses options for those factors. The expression of the cost per record is given by:  
\[\text{CPR}_{\text{i}}=\text{F}_{\text{C}}\times\text{F}_{\text{I}}\times\text {F}_{\text{D}}\times\sum\
olimits_{i=1}^{4}\text{c}_{\text{i}} \tag{9}\]  
where the factors impacting the cost per record for type i are the country of an organization that had a data breach \(\text{F}_{\text{country}}\) (\(\text{F}_{\text{C}}\)), the organization's industry classification \(\text{F}_{\text{industry}}\) (\(\text{F}_{\text{I}}\)), and the duration that the business keeps the sensitive information of employees, customers, and patients \(\text{F}_{\text{duration}}\) (\(\text{F}_{\text{D}}\)). These factors will be multiplied by the total cost per record of the four partial costs that include incident investigation, crisis management, regulatory and industry sanctions, and class action lawsuit. Each factor has a default value that is equal to one. Each factor is discussed below. Cost factor based on \(\text{F}_{\text{C}}\) depends on the organization's country and countries for which data breach cost data were collected in the IBM/Ponemon 2015 Global analysis [40]. We take the USA as the default choice. The cost in some countries is significantly lower. Then, we use a weighted cost/factor for the rest of the countries relative to the cost per record for the US, which is USD 217. Cost factor \(\text{F}_{\text{I}}\) represents the organization's industry classification. This factor takes into account different types of industry classifications. Some of the classifications have a bigger effect on the breach cost per record than others. The values of the factor of industry classifications are shown in (Table 12), and the default value is one. Cost factor \(\text{F}_{\text{D}}\) focuses on sensitive information keeping. This factor takes into consideration the fact that the businesses keep some information about their employees, customers, and patients for different lengths of time. The cost of the breach will depend on the length of time this information is retained. We determine how many months approximately are in each duration. The durations are as follows: 3, 12, 48, 72. Then, we make 48 months as the default one. After that, we plot the months with cost, make a trend line, and obtain the expression: y = 37 * months + 317. In addition, we normalize that expression by dividing all values by 2000, which is the cost of 48 months (the default). The expression becomes: y= 0.0185 * months + 0.158. The values of a factor are found by dividing the cost of each duration by 2000 that is the cost of 48 months. The values are presented in (Table 13). \begin{table}
\begin{tabular}{c c} \hline \hline
**Industry Classification** & **Multiplier** \\ \hline Communications & 1.01 \\ Consumer Products & 0.88 \\ Education & 0.85 \\ Financial Services & 1.26 \\ Government Services & 0.78 \\ Healthcare and Pharmaceuticals & 1.33 \\ Industrial & 0.80 \\ Retail & 0.84 \\ Services: professional and general services & 1.12 \\ Technology and software & 1.23 \\ Transportation & 0.90 \\ All others & 1 (default) \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Cost factor—organization’s industry classification \(\text{F}_{\text{I}}\). The cost of the data breach not only depends on the duration but also the volume of the sensitive information that is vulnerable to a breach and which should be protected using encryption [6].