Patent ID: 8166551

Claim:
A system, comprising: a first data store to store asset data that is related to an electronic information resource and that is related to a process that relies on the electronic information resource; a security risk analysis logic to identify a risk associated with the electronic information resource and to determine an impact associated with the risk occurring to the electronic information resource; a recovery logic to determine an attainable recovery for the electronic information resource after the risk occurs, where the attainable recovery includes a recovery point objective associated with a version of the electronic information resource that is to be recreated from before the risk occurring; wherein the recovery logic is configured to establish a recovery time objective that describes a first point in time when the electronic information resource is to be available after the risk occurs, and where the time objective includes a confidence factor that describes the likelihood of attaining recovery by the recovery time objective; a score logic to determine one or more values that quantify security management performance with respect to a set of electronic information resources that include the electronic information resource, where the score logic is configured to score the automated security action based at least in part on the confidence factor and achieving the recovery point objective within the recovery time objective when the automated security action occurs; a loss logic to determine a loss expectancy associated with the electronic information resource, the loss expectancy being determined from the one or more values; and a decision logic to provide a signal concerning an automated security action to be taken, where the action to be taken depends, at least in part, on the values, or the loss expectancy, wherein the recovery logic, the score logic, the loss logic, and the decision logic are embodied on a non-transitory computer readable medium.