Organisations can use CRQ for decision-making by prioritising investments based on cost-effectiveness, justifying cybersecurity spending with concrete data, comparing mitigation options, and continuously monitoring and refining their approach based on CRQ results.