The aim of the thesis is to assist top management in making correct and balanced decisions regarding information security risks and investments in information security measures by ensuring the consistency and quality of ...