A Cost-Benefit Approach to Optimizing Security Precaution Adoption

Noa Barnir, Neil Gandal, Tyler Moore and Vincent Scott

No 21220, CEPR Discussion Papers from Centre for Economic Policy Research

Abstract: All U.S defense contractors were required to have fully implemented the 110 security requirements included in NIST Special Publication 800-171 entitled “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations†by 1 January 2018 whenever a system owned, or operated by or for, a contractor processes, stores, or transmits controlled unclassified information (CUI). Despite the mandate, adoption has been minimal, mostly because the requirement is so costly and time-consuming that medium and small firms cannot afford to comply. Since the adoption of security precautions is costly and time-consuming, in this paper, we propose a constrained optimization methodology to examine this issue.

Date: 2026-02
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP21220 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:21220

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP21220

Access Statistics for this paper

More papers in CEPR Discussion Papers from Centre for Economic Policy Research 33 Great Sutton Street, London EC1V 0DX, UK.
Bibliographic data for series maintained by CEPR ().