database describes where the control would be appropriate and
ascertains its cost and effectiveness against a variety of security
breaches. The program delineates costs to the user and enables the
user to rank or prioritize controls.