For example, at the nonbank financial institution, the central security manager kept records on viruses detected and eradicated, including estimates of the cost of potential damage to computer files that was averted by the use of virus detection software.