Due to the increasing threat of cyber attacks and new legal requirements, companies are required to implement complex bundles of IT security measures (ITS measures). As companies have to decide between different ITS measures, their proper evaluation becomes a central challenge. Investment and operating costs are not the only decisive factors in the evaluation. Rather, ITS measures have a far-reaching impact on business processes, since they influence process complexity, flexibility and productivity, among other things. “Classic” evaluation approaches to investment costing, such as return on security investment, quickly reach their limits when it comes to the impact on processes.

In ProBITS, an innovative approach is being researched that will enable a process-oriented evaluation of ITS measures. The core is a multi-criteria decision model that can be used to record and evaluate ITS measures with regard to corporate processes and select them on the basis of economic target variables. In addition, further support services are planned: An extended process modeling language is being developed that takes into account the interactions between ITS measures and enterprise processes. A corresponding process model for the introduction and implementation of ITS measures will allow adequate scaling that also meets the business requirements of SMEs. Finally, the IT tool developed can be used to efficiently evaluate and select appropriate ITS measures. The effectiveness of the evaluation approach is shown in two demonstrators: First, the developed process-oriented approach is compared with classical methods. Then, the applicability of the approach is tested in the domains of health and smart meters.