Analysis preparation. This step involves the preparatory activities that are needed to perform the cost as- sessment and can be described as the core of the cost assessment. There are four major elements that together form the analysis preparation (Figure 3): • Identifying relevant cost items • Choosing estimation methods for each cost item • Collecting data • Modelling. Estimate method Cost item identification Analysis preparation Data collection Modelling Figure 3: Elements of the analysis preparation phase Cost item identification This part is about constructing a so called ‘cost tree’: a list of cost items and sub cost items applicable to the particular security solution. Usually a generic cost items list is used. The ap- plicable cost items are selected based on the security solution’s definition and its intended use and maintenance concept. Naturally, this can only be done when the previous step of the cost assessment has been successfully executed. Cost items that are not applicable to the security solution and/or its setting can be ignored or marked as ‘not applicable’. It is important to state the assumptions that are used when identifying the relevant cost items, e.g. there is no need for extra data storage because the currently available data storage is sufficient for the security so- lution’s life-time. This means that no extra costs have to be incurred. Another example is that current communication networks can be used for the security solution at hand, resulting in no extra costs for communication networks. At a high level, costs can be sub-divided into: • Procurement and installation / investment costs (CAPEX) • In-service / operational costs (OPEX) o Use; o Maintenance. • Long term cost items, e.g. costs of disposal. This can be regarded as a high level ‘cost tree’. However, to make a more accurate cost estimate, the cost tree should be extended. Table 1 shows a relatively generic example of a list of cost items that can be used for cost assessments of IT-based security solutions. The cost items list that was used for the actual SEGRID cost assessment (Annex A1) is based on this generic list but adapted in such a way that it can be used more intuitively and is fit for purpose, e.g. some items have been combined or left out because they are not of applicable for this analysis. Table 1 Generic list of cost items for IT security solutions cost assessment Investment cost items (CAPEX) Purchasing: Network hardware and software Server hardware and software Workstation...
