Senior management has requested a risk practitioner's guidance on whether a new technical control requested by a business unit is worth the investment. Which of the following should be the MOST…

While cost-benefit analysis is crucial, it cannot be fully performed without first understanding the *effectiveness* of the control (the 'benefit' side of the equation).

The core purpose of any control investment is to reduce risk. Therefore, the most important consideration is how effectively the proposed control reduces the existing residual risk to an acceptable level, demonstrating its value in achieving security objectives. Without knowing its effectiveness, assessing its 'worth' is impossible.

The likelihood of an attack is part of the initial risk assessment, but the question is about evaluating a *new control*, so the control's impact on reducing that risk (its effectiveness) is paramount.

Availability of budgeted funds is an organizational constraint, not the primary technical consideration for assessing the *worth* or effectiveness of a control.