Nevertheless, your board of directors needs to see that those bits and bytes they call "just data" are really the corporation's lifeblood. And they must get their arms around the ultimate cost to the business if that data were lost, stolen or altered.

"We need to make a model where e-business risk is wrapped in the cost of doing business -- like automobiles [that] transfer regulatory costs to the consumers," says Frank Reeder, who chairs both the computer system security and privacy advisory board at the U.S. Department of Commerce and the Center for Internet Security in Bethesda, Md.

But quantifying risk calls for statistics and benchmarks, things that are sorely lacking in this new era of e-business, says Paul Raines, head of global information risk management at Barclay's Capital, the investment division of Barclay's Group PLC in London.

"Most risk models so far have been qualitative: Define your assets by classifying your data sensitivity; define your risks [for] theft, disaster, hacking. Then you evaluate your site against these risks," Raines says. "To develop a quantitative model, you need data to determine chance and frequency. The problem is, there hasn't been historical data to draw from. The equivalent of actuarial tables will help."

The amount of data gathered concerning e-business risk is nowhere near the amount gathered during 100-plus years of the automobile. But business risk managers are currently looking at e-business risk as another element of business risk. In so doing, they're developing some early standards and metrics that