Several of the security managers expressed an interest in developing better measurement capabilities so that they could more precisely measure the ultimate benefits and drawbacks of security-related policies and controls--that is, the positive and negative affects of information security on business operations.