Advise senior management (e.g., CIO) on cost/benefit analysis of information security programs, policies, processes, systems, and elements.