Comment by rossjudson

I recommend "How to measure anything in cybersecurity risk". Really interesting read about putting actual value on security.