For example, while the university did not develop data on the actual cost of incidents, such as the cost of recovering from virus infections, the database could be used to compile such information, which would be useful in measuring the cost of security lapses and in determining how much to spend on controls to reduce such lapses.